CVE-2024-35869 (GCVE-0-2024-35869)
Vulnerability from cvelistv5
Published
2024-05-19 08:34
Modified
2026-08-05 11:30
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8e3554150d6c80a84b3cb046615d1a0e943811dc
Version: 8e3554150d6c80a84b3cb046615d1a0e943811dc
Version: 8e3554150d6c80a84b3cb046615d1a0e943811dc
Version: f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6
Version: c082c3be0f96e759ff2e361d929832fda0b93851
Version: 6.2.15   ≤
Version: 6.3.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "645f332c6b63",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e1db9ae87b71",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "062a7f0ff46e",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.29",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.8.*",
                "status": "unaffected",
                "version": "6.8.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T15:01:40.323674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:16:06.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsglob.h",
            "fs/smb/client/cifsproto.h",
            "fs/smb/client/connect.c",
            "fs/smb/client/dfs.c",
            "fs/smb/client/dfs.h",
            "fs/smb/client/dfs_cache.c",
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "645f332c6b63499cc76197f9b6bffcc659ba64cc",
              "status": "affected",
              "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc",
              "versionType": "git"
            },
            {
              "lessThan": "e1db9ae87b7148c021daee1fcc4bc71b2ac58a79",
              "status": "affected",
              "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc",
              "versionType": "git"
            },
            {
              "lessThan": "062a7f0ff46eb57aff526897bd2bebfdb1d3046a",
              "status": "affected",
              "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c082c3be0f96e759ff2e361d929832fda0b93851",
              "versionType": "git"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsglob.h",
            "fs/smb/client/cifsproto.h",
            "fs/smb/client/connect.c",
            "fs/smb/client/dfs.c",
            "fs/smb/client/dfs.h",
            "fs/smb/client/dfs_cache.c",
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: guarantee refcounted children from parent session\n\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon-\u003eses are also refcounted.  They\u0027re all needed across\nthe entire DFS mount.  Get rid of @tcon-\u003edfs_ses_list while we\u0027re at\nit, too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable refcounting is driven entirely by DFS referral responses from a remote SMB peer \u2014 the server chooses the nesting depth, target types, interlink/storage flags, and referral TTL that produce the unbalanced `dfs_root_ses` chain. A malicious/compromised SMB server, an SMB MITM, or an attacker controlling DNS for DFS target hostnames reaches this over the network.\nAC:L - This is a deterministic refcount imbalance, not a race: the server simply returns a referral topology three or more levels deep (limit is MAX_NESTED_LINKS=8) and can force the failover/reconnect path arbitrarily often by dropping TCP or setting a short TTL. Heap grooming for the subsequent UAF is routine and fully under attacker control.\nPR:N - The remote server holds no privileges on the victim host \u2014 CIFS authenticates the client to the server, not the reverse, so nothing gates the referral data on the way to the vulnerable code. The runtime `dfs_cache_refresh()` worker and DFS failover run in kernel context with no local account required at all; even the local automount path (`cifs_d_automount`) has no capability check.\nUI:N - Once a normal cifs DFS mount exists (fstab/autofs, standing configuration, not a per-exploit action), the server triggers the vulnerable failover and `dfs_cache_work` refresh paths on its own schedule with no victim participation. The automount path is likewise reached by ordinary directory traversal, not a deliberate security decision.\nS:U - The corrupted `struct cifs_ses` objects and the resulting control-flow hijack are confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of `struct cifs_ses`, which is dereferenced for `ses-\u003eserver`, `ses-\u003etcon_ipc`, `ses-\u003eSuid` and holds SMB credentials and signing/session keys; reclaiming the freed slab object yields an arbitrary-read primitive and leaks sensitive session material.\nI:H - The DFS failover path performs `server-\u003eops-\u003etree_connect(...)` \u2014 an indirect call through a function pointer read out of the freed session\u0027s `server` field \u2014 giving a direct control-flow hijack primitive once the object is reclaimed with attacker-groomed heap data.\nA:H - Dereferencing and spin-locking a freed `struct cifs_ses` from the reconnect path and the `dfs_cache_refresh` workqueue causes kernel oops/panic, and the double-put on the mount error path corrupts the session list. The server can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:31.558Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"
        },
        {
          "url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"
        }
      ],
      "title": "smb: client: guarantee refcounted children from parent session",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35869",
    "datePublished": "2024-05-19T08:34:27.645Z",
    "dateReserved": "2024-05-17T13:50:33.108Z",
    "dateUpdated": "2026-08-05T11:30:31.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.968Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35869\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-24T15:01:40.323674Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"645f332c6b63 \", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"e1db9ae87b71 \", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"062a7f0ff46e \", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \" 6.8.5\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.8.* \"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.9\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-24T15:08:25.313Z\"}}], \"cna\": {\"title\": \"smb: client: guarantee refcounted children from parent session\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable refcounting is driven entirely by DFS referral responses from a remote SMB peer \\u2014 the server chooses the nesting depth, target types, interlink/storage flags, and referral TTL that produce the unbalanced `dfs_root_ses` chain. A malicious/compromised SMB server, an SMB MITM, or an attacker controlling DNS for DFS target hostnames reaches this over the network.\\nAC:L - This is a deterministic refcount imbalance, not a race: the server simply returns a referral topology three or more levels deep (limit is MAX_NESTED_LINKS=8) and can force the failover/reconnect path arbitrarily often by dropping TCP or setting a short TTL. Heap grooming for the subsequent UAF is routine and fully under attacker control.\\nPR:N - The remote server holds no privileges on the victim host \\u2014 CIFS authenticates the client to the server, not the reverse, so nothing gates the referral data on the way to the vulnerable code. The runtime `dfs_cache_refresh()` worker and DFS failover run in kernel context with no local account required at all; even the local automount path (`cifs_d_automount`) has no capability check.\\nUI:N - Once a normal cifs DFS mount exists (fstab/autofs, standing configuration, not a per-exploit action), the server triggers the vulnerable failover and `dfs_cache_work` refresh paths on its own schedule with no victim participation. The automount path is likewise reached by ordinary directory traversal, not a deliberate security decision.\\nS:U - The corrupted `struct cifs_ses` objects and the resulting control-flow hijack are confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Use-after-free of `struct cifs_ses`, which is dereferenced for `ses-\u003eserver`, `ses-\u003etcon_ipc`, `ses-\u003eSuid` and holds SMB credentials and signing/session keys; reclaiming the freed slab object yields an arbitrary-read primitive and leaks sensitive session material.\\nI:H - The DFS failover path performs `server-\u003eops-\u003etree_connect(...)` \\u2014 an indirect call through a function pointer read out of the freed session\u0027s `server` field \\u2014 giving a direct control-flow hijack primitive once the object is reclaimed with attacker-groomed heap data.\\nA:H - Dereferencing and spin-locking a freed `struct cifs_ses` from the reconnect path and the `dfs_cache_refresh` workqueue causes kernel oops/panic, and the double-put on the mount error path corrupts the session list. The server can trigger it repeatedly.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8e3554150d6c80a84b3cb046615d1a0e943811dc\", \"lessThan\": \"645f332c6b63499cc76197f9b6bffcc659ba64cc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8e3554150d6c80a84b3cb046615d1a0e943811dc\", \"lessThan\": \"e1db9ae87b7148c021daee1fcc4bc71b2ac58a79\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8e3554150d6c80a84b3cb046615d1a0e943811dc\", \"lessThan\": \"062a7f0ff46eb57aff526897bd2bebfdb1d3046a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c082c3be0f96e759ff2e361d929832fda0b93851\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.2.15\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.3.2\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/smb/client/cifsglob.h\", \"fs/smb/client/cifsproto.h\", \"fs/smb/client/connect.c\", \"fs/smb/client/dfs.c\", \"fs/smb/client/dfs.h\", \"fs/smb/client/dfs_cache.c\", \"fs/smb/client/misc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.29\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/cifsglob.h\", \"fs/smb/client/cifsproto.h\", \"fs/smb/client/connect.c\", \"fs/smb/client/dfs.c\", \"fs/smb/client/dfs.h\", \"fs/smb/client/dfs_cache.c\", \"fs/smb/client/misc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc\"}, {\"url\": \"https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79\"}, {\"url\": \"https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: guarantee refcounted children from parent session\\n\\nAvoid potential use-after-free bugs when walking DFS referrals,\\nmounting and performing DFS failover by ensuring that all children\\nfrom parent @tcon-\u003eses are also refcounted.  They\u0027re all needed across\\nthe entire DFS mount.  Get rid of @tcon-\u003edfs_ses_list while we\u0027re at\\nit, too.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.29\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.2.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.3.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:31.558Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35869\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:31.558Z\", \"dateReserved\": \"2024-05-17T13:50:33.108Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:27.645Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.