CVE-2026-98173 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry (niface) under iface_lock. The loop body then drops iface_lock for the whole duration of cifs_ses_add_channel().
A concurrent interface refresh (SMB3_request_interfaces() -> parse_server_interfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via list_del() + kref_put(), where release_iface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->iface_head.next, and the loop body reads iface->rdma_capable/is_active, both on freed memory.
Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under iface_lock, takes a kref on the selected candidate, and passes only that referenced candidate to cifs_ses_add_channel(). weight_fulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weight_fulfilled-before-kref_put ordering on the failure path.
Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Linux kernel's Common Internet File System (CIFS) client implementation represents a critical use-after-free condition located within the cifs_try_adding_channels function. This flaw arises from an improper handling of reference counting and lock scope during concurrent interface management operations. Specifically, the function iterates through the session’s interface list using list_for_each_entry_safe_from while holding the iface_lock to capture the next entry in the sequence. However, the implementation drops this critical spinlock before invoking cifs_ses_add_channel(), creating a significant window of vulnerability where shared data structures are accessible without synchronization protection. This architectural decision allows concurrent threads or interrupt contexts to modify the interface list structure while the current execution path assumes its stability remains intact.
The operational impact is triggered by a concurrent interface refresh process, which typically occurs when SMB3_request_interfaces calls parse_server_interfaces to update network connectivity status. During this refresh, all existing interfaces are marked as inactive and removed from the active list if they are not re-advertised by the server. The removal mechanism involves calling list_del followed by kref_put, where release_iface performs a bare kernel free operation on the interface structure. Because the next iterator pointer captured before dropping the lock typically lacks an additional reference count held by any channel, it relies solely on its presence in the linked list for memory safety. Consequently, if the concurrent refresh completes and frees this entry while the original thread is suspended within cifs_ses_add_channel, the subsequent loop iteration attempts to dereference niface->iface_head.next. This results in a use-after-free scenario where the kernel reads iface->rdma_capable or is_active fields from memory that has already been returned to the allocator and potentially overwritten by other allocations.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, as it involves accessing memory after it has been freed due to incorrect reference counting management. In terms of attack vectors, while primarily exploitable through local privilege escalation or denial-of-service conditions triggered by specific network timing scenarios, the underlying logic flaw relates to improper synchronization mechanisms often associated with CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization. The ATT&CK framework would categorize this under techniques involving memory corruption for code execution or stability disruption, specifically leveraging race conditions in kernel-space drivers and subsystems.
The resolution implemented by the Linux community addresses these issues by fundamentally altering how interface candidates are selected during channel addition attempts. Instead of maintaining a pointer to an unreferenced list entry across the unlocked window, each attempt now re-scans the entire interface list from the head while holding iface_lock throughout the selection process. This ensures that any candidate chosen for cifs_ses_add_channel has its reference count incremented via kref before the lock is released. By passing only this safely referenced candidate to the channel addition function, the code guarantees that the memory remains valid regardless of concurrent interface refresh operations. Additionally, the weight_fulfilled variable continues to track selection progress, ensuring that restarting the scan preserves the original weighted distribution logic even when failures occur and reference counts are decremented on error paths.
To further mitigate potential denial-of-service risks associated with rapid network state changes, a per-pass attempts cap has been introduced into the loop logic. This constraint prevents a flapping interface refresh from causing the inner loop to spin indefinitely within a single tries increment. Without this cap, an attacker or unstable network environment could theoretically exhaust CPU resources by triggering continuous re-evaluations of the interface list during rapid state transitions. The combination of strict reference counting enforcement and bounded iteration loops ensures that the CIFS client remains robust against both memory corruption vulnerabilities and resource exhaustion attacks stemming from concurrent interface management races.