CVE-2026-98173

Что произошло

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry (niface) under iface_lock. The loop body then drops iface_lock for the whole duration of cifs_ses_add_channel(). A concurrent interface refresh (SMB3_request_interfaces() -> parse_server_interfaces()) marks all ifaces inactive and removes and frees any that are not re-advertised via list_del() + kref_put(), where release_iface() is a bare kfree(). Since niface typically has no channel holding a reference, the list reference is its last and it can be freed inside the unlocked window. On continue, the iterator advance step then dereferences niface->iface_head.next, and the loop body reads iface->rdma_capable/is_active, both on freed memory. Fix this by never keeping an unreferenced list pointer across the unlocked window. Each channel attempt now re-scans the list from the head under iface_lock, takes a kref on the selected candidate, and passes only that referenced candidate to cifs_ses_add_channel(). weight_fulfilled still tracks selection progress, so restarting the scan preserves the original weighted distribution and the weight_fulfilled-before-kref_put ordering on the failure path. Add a per-pass attempts cap so a flapping interface refresh cannot keep the inner loop spinning within a single tries increment.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
  "lessThan": "93e8a49adb2a575202c5ee766435eff2f9f95f5b",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
  "lessThan": "ee0d8f83d68f6e6509f092c997ccab3c8c801538",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
  "lessThan": "c941f1ebfd26f683de81091473f3596a218abff0",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
  "lessThan": "e99040e5e9c60441e6b4725e1a7b88c3106ae903",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
  "lessThan": "ec36b38e65596950e6c29bed7dfc90b98707c19c",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
  "lessThan": "d034e836eefd7ce75e588f7031cffbeec594f5ac",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "5.19"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "5.19",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "6.1.191",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.160",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.112",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.54",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.8",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:46.181726+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.842155+00:00"
  },
  "scores": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.842155+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.842155+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:46.181726+00:00"
  },
  "references": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:41.842155+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены03.11.2026, 00:15
2. Данные обновлены02.11.2026, 03:33
3. Данные обновлены02.11.2026, 00:13
4. Данные обновлены31.10.2026, 12:00
5. Данные обновлены30.10.2026, 20:51
6. Данные обновлены30.10.2026, 15:58
7. Данные обновлены29.10.2026, 12:47
8. Опубликована28.10.2026, 23:13

Личная заметка и статус

Другие CVE того же продукта