CVE-2026-98173

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of iface in cifs_try_adding_channels()

cifs_try_adding_channels() iterates ses->iface_list with

list_for_each_entry_safe_from(), which captures the next entry

(niface) under iface_lock. The loop body then drops iface_lock for

the whole duration of cifs_ses_add_channel().

A concurrent interface refresh (SMB3_request_interfaces() ->

parse_server_interfaces()) marks all ifaces inactive and removes and

frees any that are not re-advertised via list_del() + kref_put(),

where release_iface() is a bare kfree(). Since niface typically has

no channel holding a reference, the list reference is its last and it

can be freed inside the unlocked window. On continue, the iterator

advance step then dereferences niface->iface_head.next, and the loop

body reads iface->rdma_capable/is_active, both on freed memory.

Fix this by never keeping an unreferenced list pointer across the

unlocked window. Eac

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References