CRITICAL Introduced in 5.0
smb TgtHint UAF
CVE-2026-89636
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
02KernelScan AI Analysis
Risk summary
A use-after-free in the Linux SMB client's DFS cache can be triggered by a malicious or compromised SMB server when a victim has mounted a DFS-enabled share. The dangling target hint pointer may be dereferenced after cache flush or refresh, leading to kernel memory corruption. Systems that mount SMB shares with DFS referrals and are exposed to untrusted or semi-trusted servers are at risk.
Vulnerability analysis
When the SMB client's DFS cache flushes or refreshes an entry, it frees all target structures in the entry's target list but leaves the target hint pointer dangling at one of the freed objects. If the client later uses that hint to select a connection target, it dereferences freed memory, resulting in a use-after-free. The fix clears the hint pointer after all targets are freed so subsequent lookups know no valid hint remains. This path is reachable whenever a system has mounted an SMB share that uses DFS referrals; a malicious or man-in-the-middle server can influence cache population and refresh timing through its referral responses, requiring no privileges on the victim beyond the initial mount.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 5.0 | 6.6.157 | 3ff9462bb7a0 |
| 6.12 | 5.0 | 6.12.109 | 7507bd188564 |
| 6.18 | 5.0 | 6.18.50 | 9ab46a13798a |
| 7.2 | 5.0 | 7.2.4 | 5baab40404a9 |
| mainline | 5.0 | 7.3-rc1 | b1b741cf8e7c |
| 6.1 | 5.0 | 6.1.188 | 14f60e959b5a |