Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T11:17:06.757Z",
  "pubdate": "2026-09-25T11:17:06.757Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw located in the Linux kernel's SMB/CIFS client implementation, specifically involving Distributed File System (DFS) superblock handling.\nThe issue arises from a race condition during the DFS automount expiry process, where a superblock reference is prematurely dropped before being accessed by the kernel.\nAn attacker capable of triggering DFS automount operations could exploit this race condition to induce a slab-use-after-free condition, leading to kernel instability, potential system crashes (Denial of Service), or theoretically controlled memory corruption.\nThe vulnerability affects the SMB client component of the Linux kernel. Successful exploitation requires an attacker to coordinate precise timing between filesystem mounting/unmounting activities.\nBecause this involves memory management within kernel space, it represents a significant security risk, as it may provide a primitive for arbitrary code execution if chained with other vulnerabilities, though the primary observed impact is kernel panic.",
  "technicalDetails": "The vulnerability is a race condition rooted in the interaction between tcon_super_cb() and __cifs_get_super() during the iteration of superblocks via iterate_supers_type().\nIn the original implementation, tcon_super_cb() stored a raw pointer to a superblock without securing an active reference. The kernel mechanism iterate_supers_type() performs its tasks while holding the s_umount semaphore; however, it drops this lock and the associated passive reference before the subsequent call to __cifs_get_super() occurs.\nThis creates a window of vulnerability where a concurrent DFS automount expiry process can trigger the destruction of the superblock object. By the time the code reaches cifs_sb_active() to perform operations on the superblock, the memory has already been freed, resulting in a slab-use-after-free as detected by KASAN.\nThe attack flow involves: 1) Triggering a DFS share mount. 2) Initiating an automount expiry process to cause concurrent superblock cleanup. 3) Leveraging the race window to ensure that the pointer used by cifs_sb_active() points to deallocated memory.\nThe exploitation path relies on the kernel's reference counting mechanism failing to protect the superblock object during the specific callback sequence. Because the reference is taken too late in the lifecycle of the superblock iteration, the kernel cannot guarantee that the object remains valid for the duration of the cifs_sb_active() call.\nThe fix involves refactoring the callback logic to acquire the active reference within the iterate_supers_type() callback context, while the s_umount semaphore is still held in shared mode. This ensures the superblock's lifecycle is correctly extended and remains valid for the duration of the reference, effectively closing the race window and preventing premature deallocation.\nThis vulnerability is restricted to the CIFS/SMB client filesystem driver in the Linux kernel and necessitates local or remote access to trigger DFS-related operations that lead to automount/unmount cycles."
}