Linux kernel: Use-after-free in CIFS/SMB client multichannel handling
Summary
A use-after-free flaw in the Linux kernel CIFS/SMB client can be triggered when a secondary channel is no longer supported by the server. The code released references and then still used the server structures, which could already be freed. Published descriptions focus on crashes (denial of service) caused by a malicious or misbehaving SMB server. Exposure depends on Linux hosts that mount SMB shares with multichannel.
Affected
- Linux kernel versions with the CIFS/SMB client and multichannel support, per the CVE record and OSV. The sources give conflicting version ranges, so check your distribution's tracker.
- OSV lists versions introduced in 6.7.0, 6.8.0 and 6.13.0 as affected.
- Debian: trixie linux 6.12.107-1 is vulnerable (DSA-6568-1).
Fixed in
- Upstream stable: 6.6.158, 6.12.112, 6.18.54, 7.2.8 (per OSV).
- Debian: trixie linux 6.12.113-1 (DSA-6568-1).
- Other distributions: Unknown. Check your vendor advisory before quoting a version.
Workaround
- No workaround is confirmed. Patching is the fix.
- Restrict SMB mounts to trusted, known servers to reduce exposure.
Exploitation
- No known exploitation in the wild at the time of checking.
- Not listed in CISA KEV.
- No public proof-of-concept found.
- EPSS about 0.004 (low).
Our recommendation
- Inventory Linux hosts and appliances that mount SMB/CIFS shares.
- Install the distribution kernel update that contains the fix, then reboot.
- Verify that the NAS and SMB servers you mount are trusted.
- Monitor vendor advisories for further updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 0338489960dd git.kernel.org
- Linux kernel stable commit 717e0a25036b git.kernel.org
- OSV: CVE-2026-98261 osv.dev
- Debian DSA-6568-1 security-tracker.debian.org
- OpenCVE: CVE-2026-98261 app.opencve.io
- Red Hat CVE data via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:50.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() When a secondary channel is no longer supported by the server, cifs_chan_skip_or_disable() drops the channel reference with cifs_put_tcp_session() and then continues to use the server pointer by calling cifs_signal_cifsd_for_reconnect() on it and reading its primary_server pointer. cifs_put_tcp_session() can drop the last reference of the channel and tear it down, so both the channel and the primary server (whose reference is also dropped by cifs_put_tcp_session()) can be freed before they are signaled for reconnect. Signal the channel and the primary server and capture the primary server pointer before dropping the channel reference with cifs_put_tcp_session().
NVD references (5)
- https://git.kernel.org/stable/c/0338489960ddad6368bce55e8adbc176c523093d
- https://git.kernel.org/stable/c/717e0a25036b6c92cecace30913b2d874a4c22b8
- https://git.kernel.org/stable/c/7a1b27780b113583a94256d58dabfe7c0d9286e7
- https://git.kernel.org/stable/c/edd52eae5fcfb8433b6bb0e7cd98db438fe01227
- https://git.kernel.org/stable/c/fcc0a935bb6e37ecbf7e4335061309f896f35780
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.