CVE-2026-97562

Summary

In the Linux kernel, the following vulnerability has been resolved:

smb: client: pin DFS superblock in iterator callback

tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it.

A deterministic KASAN test reproduces the race as:

BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80

The same test passes with this change applied.

Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxbacd704a95ad0b93af995aae4a523aa046f46563 < ea43a15cea36dc5ddd832be5bddeac7dd804cbcfaffected
LinuxLinuxbacd704a95ad0b93af995aae4a523aa046f46563 < a6b6561522212af852c9ad8a7dca8d59ef2c7377affected
LinuxLinuxbacd704a95ad0b93af995aae4a523aa046f46563 < 5b01a8c0209690db75341528ec53fd87e0ac1460affected
LinuxLinuxbacd704a95ad0b93af995aae4a523aa046f46563 < d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818affected
LinuxLinux5.7affected
LinuxLinux0 < 5.7unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc3 <= *unaffected

Weaknesses

References