CVE-2024-35867

smb: client: fix potential UAF in cifs_stats_proc_show()

State: Published
Severity: 7.8 High
Published: May 19, 2024
Updated: Aug 5, 2026
Reserved: May 17, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_stats_proc_show()

Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 838ec01ea8d3deb5d123e8ed9022e8162dc3f503Affected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before bb6570085826291dc392005f9fec16ea5da3c8adAffected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 16b7d785775eb03929766819415055e367398f49Affected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before c3cf8b74c57924c0985e49a1fdf02d3395111f39Affected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 1e12f0d5c66f07c934041621351973a116fa13c7Affected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 0865ffefea197b437ba78b5dd8d8e256253efd65Affected a67172a013953664b1dad03c648200c70b90506cAffected 3.12.48 to before 3.13Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.85 through 6.1.Not affected 6.6.26 through 6.6.Not affected 6.8.5 through 6.8.*Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 838ec01ea8d3deb5d123e8ed9022e8162dc3f503Affected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before bb6570085826291dc392005f9fec16ea5da3c8adAffected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 16b7d785775eb03929766819415055e367398f49Affected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before c3cf8b74c57924c0985e49a1fdf02d3395111f39Affected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 1e12f0d5c66f07c934041621351973a116fa13c7Affected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 0865ffefea197b437ba78b5dd8d8e256253efd65Affected
a67172a013953664b1dad03c648200c70b90506cAffected
3.12.48 to before 3.13Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.85 through 6.1.*Not affected
6.6.26 through 6.6.*Not affected
6.8.5 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.