HIGH Introduced in 5.0
smb TargetHint Deref
CVE-2026-93210
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always valid. In preparation for clearing ce->tgthint in free_tgts(), harden callers of get_tgt_name() against ERR_PTR results and harden dfs_cache_noreq_update_tgthint() against NULL pointer dereferences.
02KernelScan AI Analysis
Risk summary
This vulnerability affects systems using the kernel CIFS/SMB client with DFS mounts. A malicious or man-in-the-middle SMB server can cause a kernel panic by sending DFS referral data that leaves the cache without a valid target hint. The impact is denial of service only — no data disclosure or code execution.
Vulnerability analysis
The SMB client's DFS cache can dereference a NULL pointer when processing referral responses from a server. The cache lookup and hint-update routines assume a cached target hint is always present, but if it was never set or has been cleared during teardown, the kernel takes a NULL-pointer fault and panics. The fix adds validity checks at each call site so the operations return an error instead of dereferencing a missing hint. This path is reached only when the kernel CIFS client has an active DFS mount, so a malicious or man-in-the-middle SMB server can trigger the crash by sending referral responses that leave the cache without a valid target hint.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.0 | 6.1.188 | a48328afbc3f |
| 6.6 | 5.0 | 6.6.157 | 6cb7f9fed8f4 |
| 6.12 | 5.0 | 6.12.109 | 66dbcdbb0cad |
| 6.18 | 5.0 | 6.18.50 | 846f0709559b |
| 7.2 | 5.0 | 7.2.4 | 7e32da6047d9 |
| mainline | 5.0 | 7.3-rc1 | bf86c08123c6 |
| cip/6.12 | 5.0 | 6.12.111-cip32 | 66dbcdbb0cad |