Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-06T00:00:00 kernel: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-416

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() When a secondary channel is no longer supported by the server, cifs_chan_skip_or_disable() drops the channel reference with cifs_put_tcp_session() and then continues to use the server pointer by calling cifs_signal_cifsd_for_reconnect() on it and reading its primary_server pointer. cifs_put_tcp_session() can drop the last reference of the channel and tear it down, so both the channel and the primary server (whose reference is also dropped by cifs_put_tcp_session()) can be freed before they are signaled for reconnect. Signal the channel and the primary server and capture the primary server pointer before dropping the channel reference with cifs_put_tcp_session().

A flaw was found in the Linux kernel's Common Internet File System (CIFS) client. When a secondary communication channel is disabled or no longer supported by a remote file server, the client releases session structures from memory while continuing to access them. A malicious server can exploit this use-after-free vulnerability to cause a system crash, leading to a Denial of Service (DoS).

A use-after-free occurs in cifs_chan_skip_or_disable() because cifs_put_tcp_session() can release the final reference to a secondary channel and also drop its reference to the primary server. The function then passes the potentially freed server object to cifs_signal_cifsd_for_reconnect() and reads server primary_server, creating a concrete stale object access with possible read and write effects. A malicious or compromised SMB server may be able to reach this path by changing multichannel support after secondary channels have been established. For the CVSS the PR:N value is used because a remote SMB server does not need privileges on the affected client once the CIFS session exists. AC:H reflects the required multichannel state, channel teardown conditions, and final reference lifetime. Impact is at least remote denial of service through a kernel crash. Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98261 https://nvd.nist.gov/vuln/detail/CVE-2026-98261 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98261.mbox https://kernelcve.org/list/?q=CVE-2026-98261