Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free. Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:49.370Z",
  "pubdate": "2026-09-11T20:19:49.370Z",
  "executiveSummary": "A use-after-free (UAF) and memory leak vulnerability exists in the Linux kernel CIFS client, specifically within the cifs_check_trans2() function.\nThe vulnerability is triggered during the processing of malformed secondary TRANSACT2 SMB responses.\nThe flaw allows an attacker capable of sending crafted network traffic to the CIFS client to induce memory corruption.\nSuccessful exploitation can lead to a system crash (denial of service) or potentially arbitrary code execution by leveraging the dangling buffer pointers remaining in the server structure.\nThis vulnerability affects the CIFS/SMB filesystem client implementation in the Linux kernel.\nExploitation requires the attacker to be in a position to influence the SMB communication stream, typically by acting as a malicious SMB server or intercepting traffic to inject specifically malformed secondary TRANSACT2 responses after a valid primary response has been established.\nThe risk is significant due to the nature of kernel-level memory corruption.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of state transitions within the Linux kernel CIFS client when processing multi-part TRANSACT2 responses.\nIn a multi-part TRANSACT2 exchange, the client receives a primary response, sets mid->resp_buf, and marks mid->multiRsp as true. If a subsequent secondary response is malformed or rejected by check2ndT2(), the current implementation of cifs_check_trans2() returns false, leading to logic errors in handle_mid().\nUpon a false return from cifs_check_trans2(), handle_mid() proceeds to overwrite the existing mid->resp_buf with the buffer from the secondary malformed packet. Because the original primary response buffer is not explicitly freed before this overwrite, a memory leak occurs. Furthermore, because mid->multiRsp is set, the function incorrectly skips the necessary NULL-out procedure for server->smallbuf or server->bigbuf.\nWhen the user-space thread subsequently triggers a free operation on the now-overwritten mid->resp_buf, the pointers inside the server structure remain pointing to the freed memory. The demux thread, when receiving subsequent packets, reuses these dangling pointers to store new data. This creates a classic use-after-free scenario where memory previously owned by a transaction buffer is accessed or modified by unrelated kernel tasks.\nThe attack flow proceeds as follows: 1) The attacker initiates a valid SMB request that prompts a primary TRANSACT2 response from the server. 2) The client receives the primary response and updates its internal state (mid->multiRsp = true). 3) The attacker sends a crafted, malformed secondary TRANSACT2 response. 4) The client's cifs_check_trans2() function rejects the secondary response. 5) The handle_mid() logic fails to clean up the primary buffer and leaves stale pointers in the server structure. 6) The subsequent reuse of these pointers by the demux thread allows for memory corruption or information disclosure.\nThis flaw resides in the SMB client handling logic within the Linux kernel, affecting all versions where cifs_check_trans2() handles multi-part TRANSACT2 responses in the described manner. No specific user authentication or elevated privileges are required if an attacker can mediate the SMB connection."
}