CVE-2026-74608
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, in the SMB client, cifs_try_adding_channels() can use-after-free an interface when channel creation fails and the interface list is refreshed concurrently.
Risk Assessment
Possible system crash or unpredictable behavior due to use of freed memory. This could lead to data integrity violation or attack.
Recommendation
Install a kernel patch that increments weight_fulfilled before dropping the temporary reference.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.