Riskcovery

CVE-2024-35864

smb: client: fix potential UAF in smb2_is_valid_lease_break()

State
Published
Severity
9.8 Critical
Published
May 19, 2024
Updated
Aug 5, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_is_valid_lease_break()

Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before c868cabdf6fdd61bea54532271f4708254e57fc5Affected
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before f92739fdd4522c4291277136399353d7c341fae4Affected
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before a8344e2b69bde63f713b0aa796d70dbeadffddfbAffected
  • 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 705c76fbf726c7a2f6ff9143d4013b18daaaebf1Affected
  • a67172a013953664b1dad03c648200c70b90506cAffected
  • 3.12.48 to before 3.13Affected
LinuxLinux
  • 3.13Affected
  • before 3.13Not affected
  • 6.1.85 through 6.1.*Not affected
  • 6.6.26 through 6.6.*Not affected
  • 6.8.5 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.