CVE-2026-89636

Summary

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free_tgts()

When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux54be1f6c1c37498bba557049df646cc239fa37e3 < 7507bd1885643d0461a6017767492450af1ce2a3affected
LinuxLinux54be1f6c1c37498bba557049df646cc239fa37e3 < 9ab46a13798a61d9d020b01d4e57efdabe6624faaffected
LinuxLinux54be1f6c1c37498bba557049df646cc239fa37e3 < 5baab40404a9393bcc0b7b8f1950bf2c307e0984affected
LinuxLinux54be1f6c1c37498bba557049df646cc239fa37e3 < b1b741cf8e7ce1b91d937e23decd3d3358748700affected
LinuxLinux5.0affected
LinuxLinux0 < 5.0unaffected
LinuxLinux6.12.109 <= 6.12.*unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References