CVE-2026-74608 smb: client: Fix use-after-free in cifs_try_adding_channels()
A use-after-free in the Linux kernel SMB client allows attackers to cause denial of service or execute arbitrary code via race conditions during channel creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74608?
CVE-2026-74608 is a critical use after free vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix use-after-free in cifs_try_adding_channels()
cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled.
A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory.
Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.
Which versions are affected by CVE-2026-74608?
How do I fix CVE-2026-74608?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74608 being exploited?
There is no known exploitation of CVE-2026-74608 in the wild and no public exploit code.
Sources
Also known as AZL-97124, BELL-CVE-2026-74608, DEBIAN-CVE-2026-74608, GHSA-q727-xf93-53j5, UBUNTU-CVE-2026-74608.