CVE-2026-97562
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.
How to fix
- Linux Linux3c9acc9835c304013a4faeb969fe9333d66ca9f8, ea43a15cea36dc5ddd832be5bddeac7dd804cbcf, a6b6561522212af852c9ad8a7dca8d59ef2c7377, 5b01a8c0209690db75341528ec53fd87e0ac1460, d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | bacd704a95ad0b93af995aae4a523aa046f46563 ≤ v < 3c9acc9835c304013a4faeb969fe9333d66ca9f8, bacd704a95ad0b93af995aae4a523aa046f46563 ≤ v < ea43a15cea36dc5ddd832be5bddeac7dd804cbcf, bacd704a95ad0b93af995aae4a523aa046f46563 ≤ v < a6b6561522212af852c9ad8a7dca8d59ef2c7377, bacd704a95ad0b93af995aae4a523aa046f46563 ≤ v < 5b01a8c0209690db75341528ec53fd87e0ac1460, bacd704a95ad0b93af995aae4a523aa046f46563 ≤ v < d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818, 5.7 | 3c9acc9835c304013a4faeb969fe9333d66ca9f8, ea43a15cea36dc5ddd832be5bddeac7dd804cbcf, a6b6561522212af852c9ad8a7dca8d59ef2c7377, 5b01a8c0209690db75341528ec53fd87e0ac1460, d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.