CVE-2026-97562

smb: client: pin DFS superblock in iterator callback

State: Published
Severity: 7.5 High
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: pin DFS superblock in iterator callback

tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it.

A deterministic KASAN test reproduces the race as:

BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80

The same test passes with this change applied.

Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bacd704a95ad0b93af995aae4a523aa046f46563 to before 3c9acc9835c304013a4faeb969fe9333d66ca9f8Affected bacd704a95ad0b93af995aae4a523aa046f46563 to before ea43a15cea36dc5ddd832be5bddeac7dd804cbcfAffected bacd704a95ad0b93af995aae4a523aa046f46563 to before a6b6561522212af852c9ad8a7dca8d59ef2c7377Affected bacd704a95ad0b93af995aae4a523aa046f46563 to before 5b01a8c0209690db75341528ec53fd87e0ac1460Affected bacd704a95ad0b93af995aae4a523aa046f46563 to before d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818Affected
LinuxLinux	5.7Affected before 5.7Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

bacd704a95ad0b93af995aae4a523aa046f46563 to before 3c9acc9835c304013a4faeb969fe9333d66ca9f8Affected
bacd704a95ad0b93af995aae4a523aa046f46563 to before ea43a15cea36dc5ddd832be5bddeac7dd804cbcfAffected
bacd704a95ad0b93af995aae4a523aa046f46563 to before a6b6561522212af852c9ad8a7dca8d59ef2c7377Affected
bacd704a95ad0b93af995aae4a523aa046f46563 to before 5b01a8c0209690db75341528ec53fd87e0ac1460Affected
bacd704a95ad0b93af995aae4a523aa046f46563 to before d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818Affected

LinuxLinux

5.7Affected
before 5.7Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.