< Back

CVE-2026-74608

Updated on 22 Aug 2026

Severity

9.8 Critical severity

Details

CVSS score
9.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels()

cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.

Details

Affected product:
AlmaLinux 9.2 ESU , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
linux @ 4.19.0 (+6 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 9.6 ESU In Rollout
20 kernels
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els1
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els2
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els3
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els4
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els5
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els6
  • 5.14.0-570.62.1.el9_6.tuxcare.1.els7
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els1
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els2
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els3
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els4
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els5
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els6
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els7
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els8
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els10
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els11
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els12
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els13
  • 5.14.0-570.62.1.el9_6.tuxcare.5.els14
Debian 12 Released
32 kernels
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
  • 6.1.176-1
  • 6.1.177-1
  • 6.1.180-1
Debian 13 Released
15 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
  • 6.12.101-1