Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:49.243Z",
  "pubdate": "2026-09-11T20:19:49.243Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) flaw identified in the Linux kernel's SMB client implementation.\nThe issue arises within the DFS (Distributed File System) target cache management, specifically during the cleanup of target lists.\nWhen the function free_tgts() is invoked to release structures within the ce->tlist, the internal pointer ce->tgthint is not cleared.\nThis results in a stale pointer referencing deallocated memory, which, if accessed subsequently, leads to a UAF condition.\nThe vulnerability affects systems utilizing the Linux kernel SMB client (cifs.ko) with DFS features enabled.\nAn attacker capable of triggering DFS cache operations could potentially exploit this memory corruption to cause a kernel panic, denial of service (DoS), or potentially achieve arbitrary code execution depending on memory allocator state and kernel configuration.\nRisk implications are high as the SMB client handles network-supplied data, providing a potential vector for remote triggers if an attacker can manipulate SMB/DFS server responses.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of the cache_dfs_entry structure's internal state within the Linux kernel SMB client. Specifically, the function free_tgts() is responsible for iterating through and freeing all cache_dfs_tgt structures contained within the ce->tlist member of a cache_dfs_entry (ce).\nDuring the destruction process of the target list, the code fails to nullify the ce->tgthint pointer. Since ce->tgthint is a pointer meant to point to one of the elements within the ce->tlist, it becomes a dangling pointer immediately after the list is cleared and the memory is returned to the kernel allocator.\nThe lifecycle of this vulnerability follows a specific pattern: 1) The SMB client identifies a need to refresh or tear down the DFS target cache. 2) free_tgts() is called, which performs a kfree() or similar deallocation on the cache_dfs_tgt elements. 3) The ce->tgthint remains pointing to the memory address of the previously freed object.\nThe exploitation occurs if the kernel subsequently attempts to use the ce->tgthint pointer without re-validating the integrity of the cache. Because the memory formerly occupied by the target structure may have been re-allocated and repurposed by other kernel subsystems, the pointer dereference will access inconsistent data or attacker-controlled memory.\nThe attack flow requires the attacker to be in a position to influence the SMB client's interaction with a DFS-capable SMB server. By providing malformed or specific DFS referrals, an attacker can force the kernel into a state where the target cache is rebuilt or cleared under precise conditions.\nA successful exploit results in memory corruption, where the kernel reads from or writes to the stale memory address. Depending on the state of the heap at the time of the UAF, this can lead to system instability, information leakage, or, in complex scenarios involving object overlapping, the hijacking of kernel control flow.\nThis flaw resides in the SMB client's DFS handling routines. It is exposed to any network environment where a client mounts an SMB share with DFS support enabled, making it potentially reachable via malicious SMB server configurations."
}