CVE-2026-74608 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix use-after-free in cifs_try_adding_channels()
cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.
A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.
Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified as a use-after-free condition in the Linux kernel's Common Internet File System client implementation stems from a race condition within the cifs_try_adding_channels function. This specific flaw occurs during the process of adding network channels to an existing session, where the code manages references to interface structures that represent available network paths for SMB connections. The core issue lies in the ordering of operations when handling reference counts and updating internal state variables related to channel fulfillment weights. Specifically, the function acquires a temporary reference count on an interface object before releasing the iface_lock mutex. This design choice is intended to keep the structure alive during critical sections but introduces a window for concurrent modifications that can lead to premature memory deallocation if error paths are taken incorrectly.
The technical flaw manifests when cifs_ses_add_channel encounters a failure condition after the temporary reference has been acquired but before it is properly released. In such scenarios, the code path executes kref_put to drop the temporary reference and subsequently attempts to increment iface->weight_fulfilled. However, because the lock was dropped earlier in the sequence, another thread performing an interface list refresh can concurrently remove or free that same interface structure. If this concurrent operation completes before the error-handling code finishes its update of weight_fulfilled, the subsequent write access targets memory that has already been freed and potentially reallocated for other purposes. This constitutes a classic use-after-free vulnerability where stale pointers are dereferenced after their underlying objects have been destroyed by the kernel's reference counting mechanism.
From an operational impact perspective, this race condition can lead to severe stability issues within the Linux operating system. Depending on how quickly the freed memory is reused and what data occupies that space at the time of access, the consequence may range from a simple kernel panic or oops due to invalid memory access, to more sophisticated exploitation scenarios where an attacker might achieve arbitrary code execution with kernel privileges. Since this vulnerability resides in the SMB client component, it affects systems actively connecting to network file shares. While local privilege escalation is not directly implied by the flaw itself, the potential for denial of service through system crashes makes this a significant reliability concern for enterprise environments relying on CIFS mounts. Furthermore, if an attacker can influence the timing or outcome of channel addition failures, they might exploit the race condition more reliably to trigger memory corruption states that facilitate further attacks against the host kernel.
The resolution implemented in the patch addresses this concurrency issue by reordering the operations within cifs_try_adding_channels. The fix ensures that iface->weight_fulfilled is incremented before dropping the temporary reference count on the interface structure. By maintaining the reference until after all necessary updates to the interface's internal state are complete, the code guarantees that the memory remains valid throughout the entire critical section of the operation. This simple change eliminates the window where a concurrent refresh could free the object while it is still being accessed by the channel addition logic. It aligns with standard practices for managing reference counts in kernel subsystems to prevent premature deallocation during multi-step operations involving shared data structures.
This vulnerability maps directly to CWE-416, which describes Use After Free errors where a pointer references memory that has already been freed. In terms of the MITRE ATT&CK framework, this type of flaw is often associated with techniques related to privilege escalation or defense evasion if exploited successfully, falling under categories such as Tactic 0003 Persistence or Tactic 0006 Defense Evasion depending on the specific exploitation method used by an adversary. The root cause also reflects CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, highlighting that the failure was not in a single thread but rather in the coordination between multiple threads accessing shared kernel data structures without adequate protection during all phases of their lifecycle management.
Mitigation strategies for this vulnerability primarily involve applying the provided kernel patch to update the affected systems. Administrators should ensure that Linux kernels are kept up-to-date with security fixes, particularly those addressing SMB client components which interact frequently with external network resources. For environments where immediate patching is not feasible, monitoring logs for unusual kernel panics or oops messages related to CIFS operations can help detect potential exploitation attempts or instability caused by the race condition. Additionally, reducing the frequency of interface list refreshes during high-load channel addition scenarios might reduce the probability window, although this is a workaround rather than a fix. The definitive solution remains applying the code change that enforces correct reference counting order to ensure memory safety under concurrent access conditions.