CVE-2026-97562: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Засегнати продукти

• Linux Linux: bacd704a95ad0b93af995aae4a523aa046f46563 преди 3c9acc9835c304013a4faeb969fe9333d66ca9f8; bacd704a95ad0b93af995aae4a523aa046f46563 преди ea43a15cea36dc5ddd832be5bddeac7dd804cbcf; bacd704a95ad0b93af995aae4a523aa046f46563 преди a6b6561522212af852c9ad8a7dca8d59ef2c7377; bacd704a95ad0b93af995aae4a523aa046f46563 преди 5b01a8c0209690db75341528ec53fd87e0ac1460; bacd704a95ad0b93af995aae4a523aa046f46563 преди d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818
• Linux Linux: 5.7; преди 5.7; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-97562
• https://nvd.nist.gov/vuln/detail/CVE-2026-97562
• https://git.kernel.org/stable/c/3c9acc9835c304013a4faeb969fe9333d66ca9f8
• https://git.kernel.org/stable/c/ea43a15cea36dc5ddd832be5bddeac7dd804cbcf
• https://git.kernel.org/stable/c/a6b6561522212af852c9ad8a7dca8d59ef2c7377
• https://git.kernel.org/stable/c/5b01a8c0209690db75341528ec53fd87e0ac1460
• https://git.kernel.org/stable/c/d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818