Look up another CVE · open CVE-2026-98174 in the interactive tracker
CVE-2026-98174
smb: client: fix rlist race and missing initialization
Published 2026-10-06 (13 days ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-98174 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6568-1 · 2026-10-16 · text | 6.12.113-1 | Update the kernel and reboot. DSA-6568-1 shipped the fix on 2026-10-16, in 6.12.113-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer. Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/client/connect.c
- What this is
- COMMON INTERNET FILE SYSTEM CLIENT (CIFS and SMB3)MAINTAINERS section matched on fs/smb/client/ · linux-cifs@vger.kernel.org · Supported
- Kernel module
- cifs
Check it on the machine
grep -wE 'CONFIG_CIFS|CONFIG_SMBFS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cifsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_CIFS, CONFIG_SMBFS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-10-06 (13 days ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.36%, higher than 28.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 0 | 6.6.158 | b5f924ffbfa9 |
| 0 | 6.12.112 | 5a8f82f9c583 |
| 0 | 6.18.54 | 04082b183385 |
| 0 | 7.2.8 | c037d6bde3dd |
| 0 | 7.3 | 5f270f091256 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-6568-1 | 2026-10-16 | trixie 6.12.113-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The trigger is SMB transport data sent by the server: an unexpected RFC1002 frame type, or a framing or decrypt error, on two channels makes is_smb_response()/smb2ops call cifs_reconnect(server, true). That leads to __cifs_reconnect() -> cifs_signal_cifsd_for_reconnect(all_channels=true) in two cifsd threads at once. The server's TCP traffic is routable.
- AC:HAttack complexity, high
- The attacker must get the two channels' list_add(&nserver->rlist, &reco) calls inside the short window after one thread drops cifs_tcp_ses_lock and before it finishes walking its on-stack reco list. Timing that from frames sent over the network is unreliable. The bug also needs a multichannel session (chan_count > 1), and that is not the default.
- PR:NPrivileges required, none
- A malicious SMB server, or an on-path attacker on the client's SMB connections, needs no account on the victim host. The reconnect is triggered by RFC1002 frames that cifsd parses before any check on the server's authenticity.
- UI:RUser interaction, required
- A victim has to mount a share from the attacker's server with the non-default multichannel or max_channels>1 option. Otherwise ses->chan_count stays 1 and the loop over chans[1..] in cifs_signal_cifsd_for_reconnect() never adds anything to reco.
- S:UScope, unchanged
- The corruption is in the CIFS client's TCP_Server_Info list linkage and other kernel stack frames, inside the same kernel security authority. No guest/host, IOMMU or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- One TCP_Server_Info.rlist node ends up linked into two cifsd threads' on-stack reco lists. list_for_each_entry_safe() can then follow a pointer into another thread's stack, which may already be dead, and treat it as a TCP_Server_Info. That is kernel memory corruption that can be steered into reads of controlled memory.
- I:HIntegrity impact, high
- The bogus entry is passed to set_need_reco() (spin_lock and a tcpStatus write) and to cifs_put_tcp_session() (srv_count decrement and possible teardown and free). Those are kernel writes through a corrupted list pointer, the same class as list-corruption write primitives.
- A:HAvailability impact, high
- With CONFIG_LIST_HARDENED/DEBUG_LIST, the first list_del_init() on the doubly linked rlist BUGs. Without it, the walk faults or loops on the corrupted reco list. The server can resend bad frames after every reconnect, so it can keep retrying until the client host crashes.