In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix use-after-free in cifs_try_adding_channels()
cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.
A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.
Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.18.48-107.148Upgrade kernel6.18-headersUpgrade kernel6.18-tools-develUpgrade kernel6.18-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18Upgrade kernel6.18-toolsUpgrade bpftool6.18Upgrade kernel6.18-modules-extraUpgrade python3-perf6.18Upgrade bpftool6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade perf6.18Upgrade microvm-kernel6.18Upgrade kernel6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade python3-perf6.18-debuginfo | Sep 30, 2026 | Aug 22, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | No solution exists | Aug 26, 2026 | Aug 22, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub