Riskcovery

CVE-2024-35863

smb: client: fix potential UAF in is_valid_oplock_break()

State
Published
Severity
9.8 Critical
Published
May 19, 2024
Updated
Aug 5, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in is_valid_oplock_break()

Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 494c91e1e9413b407d12166a61b84200d4d54facAffected
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 0a15ba88a32fa7a516aff7ffd27befed5334dff2Affected
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 16d58c6a7db5050b9638669084b63fc05f951825Affected
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29Affected
  • a67172a013953664b1dad03c648200c70b90506cAffected
  • 3.12.48 to before 3.13Affected
LinuxLinux
  • 3.13Affected
  • before 3.13Not affected
  • 6.1.85 through 6.1.*Not affected
  • 6.6.26 through 6.6.*Not affected
  • 6.8.5 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.