{"id":"CVE-2026-98175","revision":"635316fea30a43bb81b9f1433397c388","records":[{"revision":"635316fea30a43bb81b9f1433397c388","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98175","aliases":[],"title":"smb: client: cancel reconnect work in clean_demultiplex_info()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server->echo delayed work but not\nserver->reconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n  cifs_demultiplex_thread()\n    cifs_readv_from_socket()\n      cifs_reconnect()\n        __cifs_reconnect()\n          cifs_queue_server_reconn()\n            mod_delayed_work(cifsiod_wq, &server->reconnect, 0)\n    clean_demultiplex_info()\n      cancel_delayed_work_sync(&server->echo)   // echo canceled\n                                                 // reconnect NOT canceled\n      kfree_sensitive(server)                    // server freed\n\n  ...later, on cifsiod_wq:\n\n  smb2_reconnect_server()\n    server->srv_count  // UAF read of freed server\n\nFix this by canceling server->reconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does.","state":0,"publishedAt":"2026-10-06T08:44:19.155+00:00","modifiedAt":"2026-10-19T09:15:06.742+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/connect.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"53e0e11efe9289535b060a51d4cf37c25e0d0f2b\",\n                            \"lessThan\": \"180380272f116dbd2b0354c5c7872e112e519149\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"53e0e11efe9289535b060a51d4cf37c25e0d0f2b\",\n                            \"lessThan\": \"e3f6a779433d13aafb5edab59e4f9313051e8a52\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"53e0e11efe9289535b060a51d4cf37c25e0d0f2b\",\n                            \"lessThan\": \"7ab9ceedd860216fb97f2d8574cbe58b8906f42a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"53e0e11efe9289535b060a51d4cf37c25e0d0f2b\",\n                            \"lessThan\": \"2e5103e11a17c274715dd56cf185eeedccf686b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"53e0e11efe9289535b060a51d4cf37c25e0d0f2b\",\n                            \"lessThan\": \"c65eae6f61d1778ff7a82e4aae4080e26f486af1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e008a962311a875a828cbae54b43285858aaa6c8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"123b228a09b90b50b0a9d6eb8294cf0c42efc029\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0d2a4c82942e2f51e4984beea1f7e5a994bd06c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15a12fbbf365a483b1c19f9caeb707b3bea77e10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0b715409cb9cf7e21e690f9b163047739761962\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ff04da387c10b6bf7b510392742c8cd46c130fd6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48f9526f4dcb4b132fe0dc2450835311e3b013a6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.10.107\",\n                            \"lessThan\": \"3.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.12.70\",\n                            \"lessThan\": \"3.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.16.42\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.18.47\",\n                            \"lessThan\": \"3.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.1.38\",\n                            \"lessThan\": \"4.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.4.40\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.8.16\",\n                            \"lessThan\": \"4.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.9.1\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/connect.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149","https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52","https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a","https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8","https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98175","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98175","identifiers":["CVE-2026-98175"]},"retained":false,"historicalAffected":[]}],"coverage":[]}