CVE-2026-98175
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. This flaw allows a malicious server or network disruption to cause a Denial of Service (DoS) or memory corruption. The issue occurs because the client fails to cancel queued reconnection tasks before freeing connection tracking resources, resulting in a use-after-free condition when the queued task subsequently accesses the freed memory.
Statement
A use after free can occur in the SMB client when clean_demultiplex_info frees a TCP_Server_Info object while delayed reconnect work remains queued on cifsiod_wq. The queued smb2_reconnect_server callback can later dereference the freed server object after a reconnect was scheduled during demultiplex thread teardown. A malicious SMB server or an attacker able to interfere with the SMB transport may trigger reconnect activity and race it with connection teardown. For the CVSS the PR:N is used because the attacker needs no local privileges on the victim after the victim has established an SMB client connection. The attack is network reachable but has AC:H because it depends on a timing sensitive race between queued work and object destruction. Impact is at least kernel denial of service. The confirmed use after free can plausibly provide limited confidentiality or integrity impact if the freed object is reused before the callback executes. SMB client connections are commonly used in enterprise or internal networks. Practical exploitation normally requires control of a configured SMB server or a network position that can disrupt the SMB connection.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
Confidentiality
Technical Impact: Read Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
