CVE-2026-98175 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: cancel reconnect work in clean_demultiplex_info()
clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued:
cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed
...later, on cifsiod_wq:
smb2_reconnect_server() server->srv_count // UAF read of freed server
Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified as a use-after-free flaw within the Common Internet File System client implementation stems from an inconsistency in resource cleanup procedures during session teardown. The core issue resides in the clean_demultiplex_info function, which is responsible for releasing resources associated with a server connection when the demultiplex thread exits. While this routine correctly cancels and waits for the completion of the server echo delayed work item to prevent race conditions related to keep-alive packets, it fails to perform an equivalent cancellation for the server reconnect delayed work item. This oversight creates a critical window where the kernel may free the server structure memory while a scheduled reconnection task remains queued in the cifsiod worker queue.
The operational impact of this flaw is severe, as it leads to undefined behavior and potential system instability or privilege escalation depending on how the freed memory is subsequently accessed. When the demultiplex thread terminates, clean_demultiplex_info executes kfree_sensitive to release the server structure. However, if a reconnect work item was previously queued via cifs_queue_server_reconn using mod_delayed_work, that task continues to exist in the system's execution queue. Once the worker thread processes this stale entry, it invokes smb2_reconnect_server, which attempts to read from fields within the now-freed server structure, such as srv_count. This constitutes a classic use-after-free condition where memory is accessed after its lifetime has ended, potentially allowing an attacker who can trigger rapid connection failures and reconnections to corrupt kernel memory or execute arbitrary code with kernel privileges.
From a technical perspective, this vulnerability aligns with CWE-416, Use After Free, as the program continues to use a pointer that no longer points to valid memory. The attack vector likely involves manipulating network conditions to force repeated connection drops and subsequent reconnection attempts, thereby increasing the probability of the race condition occurring during the cleanup phase. In terms of offensive security frameworks, this scenario relates to ATT&CK technique T1059, Command and Scripting Interpreter, if exploited for code execution, or more broadly to privilege escalation vectors where kernel memory corruption is leveraged to bypass access controls. The flaw highlights a common pattern in complex driver development where cleanup routines must meticulously mirror the initialization sequence to ensure all asynchronous tasks are properly terminated before resource deallocation occurs.
The resolution involves modifying clean_demultiplex_info to explicitly cancel and synchronize with the server reconnect delayed work item, mirroring the logic already present in cifs_put_tcp_session. By calling cancel_delayed_work_sync on the reconnect task before freeing the server structure, the kernel ensures that any pending reconnection attempts are aborted and their execution contexts are safely joined or discarded prior to memory release. This fix restores consistency in resource management across different code paths handling session termination. To mitigate this risk, system administrators should apply the latest available kernel updates for affected distributions immediately. Additionally, monitoring logs for unusual SMB connection churn or errors related to cifsiod worker threads can help identify systems potentially experiencing stress from conditions that might trigger this race condition before a patch is applied.