CVE-2026-89636

smb: client: clear ce->tgthint in free_tgts()

State: Published
Severity: 9.8 Critical
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free_tgts()

When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	54be1f6c1c37498bba557049df646cc239fa37e3 to before 14f60e959b5ac813715ff72e127beb3584ddabf6Affected 54be1f6c1c37498bba557049df646cc239fa37e3 to before 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55Affected 54be1f6c1c37498bba557049df646cc239fa37e3 to before 7507bd1885643d0461a6017767492450af1ce2a3Affected 54be1f6c1c37498bba557049df646cc239fa37e3 to before 9ab46a13798a61d9d020b01d4e57efdabe6624faAffected 54be1f6c1c37498bba557049df646cc239fa37e3 to before 5baab40404a9393bcc0b7b8f1950bf2c307e0984Affected 54be1f6c1c37498bba557049df646cc239fa37e3 to before b1b741cf8e7ce1b91d937e23decd3d3358748700Affected
LinuxLinux	5.0Affected before 5.0Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

54be1f6c1c37498bba557049df646cc239fa37e3 to before 14f60e959b5ac813715ff72e127beb3584ddabf6Affected
54be1f6c1c37498bba557049df646cc239fa37e3 to before 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55Affected
54be1f6c1c37498bba557049df646cc239fa37e3 to before 7507bd1885643d0461a6017767492450af1ce2a3Affected
54be1f6c1c37498bba557049df646cc239fa37e3 to before 9ab46a13798a61d9d020b01d4e57efdabe6624faAffected
54be1f6c1c37498bba557049df646cc239fa37e3 to before 5baab40404a9393bcc0b7b8f1950bf2c307e0984Affected
54be1f6c1c37498bba557049df646cc239fa37e3 to before b1b741cf8e7ce1b91d937e23decd3d3358748700Affected

LinuxLinux

5.0Affected
before 5.0Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.