CVE-2026-98175

smb: client: cancel reconnect work in clean_demultiplex_info()

State: Published
Severity: 7.5 High
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: cancel reconnect work in clean_demultiplex_info()

clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued:

cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed

...later, on cifsiod_wq:

smb2_reconnect_server() server->srv_count // UAF read of freed server

Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before 180380272f116dbd2b0354c5c7872e112e519149Affected 53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before e3f6a779433d13aafb5edab59e4f9313051e8a52Affected 53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before 7ab9ceedd860216fb97f2d8574cbe58b8906f42aAffected 53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before 2e5103e11a17c274715dd56cf185eeedccf686b8Affected 53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before c65eae6f61d1778ff7a82e4aae4080e26f486af1Affected e008a962311a875a828cbae54b43285858aaa6c8Affected 123b228a09b90b50b0a9d6eb8294cf0c42efc029Affected 0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9Affected d0d2a4c82942e2f51e4984beea1f7e5a994bd06cAffected 15a12fbbf365a483b1c19f9caeb707b3bea77e10Affected f0b715409cb9cf7e21e690f9b163047739761962Affected ff04da387c10b6bf7b510392742c8cd46c130fd6Affected 48f9526f4dcb4b132fe0dc2450835311e3b013a6Affected 3.10.107 to before 3.11Affected 3.12.70 to before 3.13Affected 3.16.42 to before 3.17Affected 3.18.47 to before 3.19Affected 4.1.38 to before 4.2Affected 4.4.40 to before 4.5Affected 4.8.16 to before 4.9Affected 4.9.1 to before 4.10Affected
LinuxLinux	4.10Affected before 4.10Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before 180380272f116dbd2b0354c5c7872e112e519149Affected
53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before e3f6a779433d13aafb5edab59e4f9313051e8a52Affected
53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before 7ab9ceedd860216fb97f2d8574cbe58b8906f42aAffected
53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before 2e5103e11a17c274715dd56cf185eeedccf686b8Affected
53e0e11efe9289535b060a51d4cf37c25e0d0f2b to before c65eae6f61d1778ff7a82e4aae4080e26f486af1Affected
e008a962311a875a828cbae54b43285858aaa6c8Affected
123b228a09b90b50b0a9d6eb8294cf0c42efc029Affected
0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9Affected
d0d2a4c82942e2f51e4984beea1f7e5a994bd06cAffected
15a12fbbf365a483b1c19f9caeb707b3bea77e10Affected
f0b715409cb9cf7e21e690f9b163047739761962Affected
ff04da387c10b6bf7b510392742c8cd46c130fd6Affected
48f9526f4dcb4b132fe0dc2450835311e3b013a6Affected
3.10.107 to before 3.11Affected
3.12.70 to before 3.13Affected
3.16.42 to before 3.17Affected
3.18.47 to before 3.19Affected
4.1.38 to before 4.2Affected
4.4.40 to before 4.5Affected
4.8.16 to before 4.9Affected
4.9.1 to before 4.10Affected

LinuxLinux

4.10Affected
before 4.10Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.