{"id":"CVE-2026-98261","revision":"dd3043fdaa104e24ac2bc02d2fdfa093","records":[{"revision":"dd3043fdaa104e24ac2bc02d2fdfa093","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98261","aliases":[],"title":"cifs: Fix server use-after-free in cifs_chan_skip_or_disable()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix server use-after-free in cifs_chan_skip_or_disable()\n\nWhen a secondary channel is no longer supported by the server,\ncifs_chan_skip_or_disable() drops the channel reference with\ncifs_put_tcp_session() and then continues to use the server pointer by\ncalling cifs_signal_cifsd_for_reconnect() on it and reading its\nprimary_server pointer. cifs_put_tcp_session() can drop the last\nreference of the channel and tear it down, so both the channel and the\nprimary server (whose reference is also dropped by\ncifs_put_tcp_session()) can be freed before they are signaled for\nreconnect.\n\nSignal the channel and the primary server and capture the primary\nserver pointer before dropping the channel reference with\ncifs_put_tcp_session().","state":0,"publishedAt":"2026-10-06T08:45:25.361+00:00","modifiedAt":"2026-10-19T09:16:32.334+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/smb2pdu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"50e8363ecc85da49764781da90ebffe1a657b370\",\n                            \"lessThan\": \"0338489960ddad6368bce55e8adbc176c523093d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f591062bdbf4742b7f1622173017f19e927057b0\",\n                            \"lessThan\": \"edd52eae5fcfb8433b6bb0e7cd98db438fe01227\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f591062bdbf4742b7f1622173017f19e927057b0\",\n                            \"lessThan\": \"fcc0a935bb6e37ecbf7e4335061309f896f35780\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f591062bdbf4742b7f1622173017f19e927057b0\",\n                            \"lessThan\": \"7a1b27780b113583a94256d58dabfe7c0d9286e7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f591062bdbf4742b7f1622173017f19e927057b0\",\n                            \"lessThan\": \"717e0a25036b6c92cecace30913b2d874a4c22b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d61ba1d71ea6039eca7ada870bf3f0c3c8fc12e4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.15\",\n                            \"lessThan\": \"6.6.158\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.3\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/smb2pdu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/0338489960ddad6368bce55e8adbc176c523093d","https://git.kernel.org/stable/c/edd52eae5fcfb8433b6bb0e7cd98db438fe01227","https://git.kernel.org/stable/c/fcc0a935bb6e37ecbf7e4335061309f896f35780","https://git.kernel.org/stable/c/7a1b27780b113583a94256d58dabfe7c0d9286e7","https://git.kernel.org/stable/c/717e0a25036b6c92cecace30913b2d874a4c22b8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98261","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98261","identifiers":["CVE-2026-98261"]},"retained":false,"historicalAffected":[]}],"coverage":[]}