CVE-2026-98175

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The SMB server at the other end of the client's TCP connection triggers the bug. When it resets the connection or sends an oversized SMB response, cifs_demultiplex_thread() calls cifs_reconnect() and then __cifs_reconnect(), which queues server->reconnect via cifs_queue_server_reconn(). clean_demultiplex_info() then frees the server without cancelling that work.

AC:HAttack complexity, high

The malicious server can force reconnects whenever it likes. The free, though, only happens when the client drops its last TCP session reference (umount or a session put, via cifs_put_tcp_session) inside the window where __cifs_reconnect has re-queued the reconnect work. Then smb2_reconnect_server must run after kfree(server). The server cannot produce that client-side timing on demand.

PR:NPrivileges required, none

A remote SMB server needs no credentials on the client host to drop its own connection or send a malformed response that drives the client into __cifs_reconnect. Mounting locally is not a lower-privilege route: cifs_fs_type has no FS_USERNS_MOUNT, so a local attacker would need real CAP_SYS_ADMIN.

UI:RUser interaction, required

The client has to mount a share from the attacker's SMB server, and a demultiplex thread only exists after that mount. The free also needs the client to unmount or otherwise drop the session at the wrong moment.

S:UScope, unchanged

The freed struct TCP_Server_Info and the cifsiod_wq worker that uses it after free are both in the client kernel. No VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

smb2_reconnect_server() reads server->srv_count from the freed TCP_Server_Info. If a reallocated object puts a nonzero value there, the worker carries on and dereferences primary_server, the reconnect_mutex and the session lists, all of which a heap spray would control.

I:HIntegrity impact, high

With a nonzero srv_count in reclaimed memory, the worker increments it, takes reconnect_mutex, manipulates the ses and tcon lists and calls cifs_put_tcp_session on the stale pointer. Those are writes through attacker-shaped memory, so they can corrupt kernel data.

A:HAvailability impact, high

syzbot reproduced this use-after-free of TCP_Server_Info in smb2_reconnect_server. A stale worker running on the shared cifsiod_wq workqueue can oops or panic the client kernel.