CVE-2026-98174

smb: client: fix rlist race and missing initialization

State: Published
Severity: 7.5 High
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix rlist race and missing initialization

TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer.

Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b5f924ffbfa976e4b97f17e8132c595b97482c2dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5a8f82f9c5839389cf4036029dd75a9911049e83Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 04082b1833856cb9ed87e0d3d5f04cbf836cf7daAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c037d6bde3dd5fa00b017b6b98a5389ec0ebc02fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5f270f091256da1338c3631083e15d7f83cc05e1Affected before 6.6.158Affected before 6.12.112Affected before 6.18.54Affected before 7.2.8Affected
LinuxLinux	6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b5f924ffbfa976e4b97f17e8132c595b97482c2dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5a8f82f9c5839389cf4036029dd75a9911049e83Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 04082b1833856cb9ed87e0d3d5f04cbf836cf7daAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c037d6bde3dd5fa00b017b6b98a5389ec0ebc02fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5f270f091256da1338c3631083e15d7f83cc05e1Affected
before 6.6.158Affected
before 6.12.112Affected
before 6.18.54Affected
before 7.2.8Affected

LinuxLinux

6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.