CVE-2024-35869
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In the Linux kernel, a use-after-free vulnerability in the SMB client was fixed, affecting DFS referral handling, mounting, and DFS failover. The fix ensures all children from the parent session are properly refcounted and removes the unnecessary dfs_ses_list.
Risk Assessment
The vulnerability could lead to system crashes or potential code execution by a local user with SMB mount privileges, posing a threat to system integrity and availability.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix for CVE-2024-35869 as soon as possible.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too.