CVE-2024-35999

smb3: missing lock when picking channel

State: Published
Severity: 7.5 High
Published: May 20, 2024
Updated: Aug 5, 2026
Reserved: May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb3: missing lock when picking channel

Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index.

Addresses-Coverity: 1582039 ("Data race condition (MISSING_LOCK)")

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	724244cdb3828522109c88e56a0242537aefabe9 to before 98c7ed29cd754ae7475dc7cb3f33399fda902729Affected 724244cdb3828522109c88e56a0242537aefabe9 to before 0fcf7e219448e937681216353c9a58abae6d3c2eAffected 724244cdb3828522109c88e56a0242537aefabe9 to before 60ab245292280905603bc0d3654f4cf8fceccb00Affected 724244cdb3828522109c88e56a0242537aefabe9 to before 8094a600245e9b28eb36a13036f202ad67c1f887Affected 3d74c2c917e4006a3bd660d2fc7829cb2ef64113Affected 5.15.27 to before 5.16Affected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.91 through 6.1.Not affected 6.6.30 through 6.6.Not affected 6.8.9 through 6.8.*Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

724244cdb3828522109c88e56a0242537aefabe9 to before 98c7ed29cd754ae7475dc7cb3f33399fda902729Affected
724244cdb3828522109c88e56a0242537aefabe9 to before 0fcf7e219448e937681216353c9a58abae6d3c2eAffected
724244cdb3828522109c88e56a0242537aefabe9 to before 60ab245292280905603bc0d3654f4cf8fceccb00Affected
724244cdb3828522109c88e56a0242537aefabe9 to before 8094a600245e9b28eb36a13036f202ad67c1f887Affected
3d74c2c917e4006a3bd660d2fc7829cb2ef64113Affected
5.15.27 to before 5.16Affected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.91 through 6.1.*Not affected
6.6.30 through 6.6.*Not affected
6.8.9 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.