CVE-2026-98174 (GCVE-0-2026-98174)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_empty() always return false and list_add() dereference a NULL ->prev pointer. Also, cifs_signal_cifsd_for_reconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 0   ≤
Version: 0   ≤
Version: 0   ≤
Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5f924ffbfa976e4b97f17e8132c595b97482c2d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5a8f82f9c5839389cf4036029dd75a9911049e83",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "04082b1833856cb9ed87e0d3d5f04cbf836cf7da",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5f270f091256da1338c3631083e15d7f83cc05e1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.112",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.54",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix rlist race and missing initialization\n\nTCP_Server_Info.rlist is allocated via kzalloc which zeros both -\u003enext\nand -\u003eprev to NULL instead of pointing to itself, making list_empty()\nalways return false and list_add() dereference a NULL -\u003eprev pointer.\n\nAlso, cifs_signal_cifsd_for_reconnect() can be called concurrently\nfrom multiple cifsd threads, allowing the same server\u0027s rlist node to\nbe added twice into the local list, corrupting it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is SMB transport data sent by the server: an unexpected RFC1002 frame type, or a framing or decrypt error, on two channels makes is_smb_response()/smb2ops call cifs_reconnect(server, true). That leads to __cifs_reconnect() -\u003e cifs_signal_cifsd_for_reconnect(all_channels=true) in two cifsd threads at once. The server\u0027s TCP traffic is routable.\nAC:H - The attacker must get the two channels\u0027 list_add(\u0026nserver-\u003erlist, \u0026reco) calls inside the short window after one thread drops cifs_tcp_ses_lock and before it finishes walking its on-stack reco list. Timing that from frames sent over the network is unreliable. The bug also needs a multichannel session (chan_count \u003e 1), and that is not the default.\nPR:N - A malicious SMB server, or an on-path attacker on the client\u0027s SMB connections, needs no account on the victim host. The reconnect is triggered by RFC1002 frames that cifsd parses before any check on the server\u0027s authenticity.\nUI:R - A victim has to mount a share from the attacker\u0027s server with the non-default multichannel or max_channels\u003e1 option. Otherwise ses-\u003echan_count stays 1 and the loop over chans[1..] in cifs_signal_cifsd_for_reconnect() never adds anything to reco.\nS:U - The corruption is in the CIFS client\u0027s TCP_Server_Info list linkage and other kernel stack frames, inside the same kernel security authority. No guest/host, IOMMU or sandbox boundary is crossed.\nC:H - One TCP_Server_Info.rlist node ends up linked into two cifsd threads\u0027 on-stack reco lists. list_for_each_entry_safe() can then follow a pointer into another thread\u0027s stack, which may already be dead, and treat it as a TCP_Server_Info. That is kernel memory corruption that can be steered into reads of controlled memory.\nI:H - The bogus entry is passed to set_need_reco() (spin_lock and a tcpStatus write) and to cifs_put_tcp_session() (srv_count decrement and possible teardown and free). Those are kernel writes through a corrupted list pointer, the same class as list-corruption write primitives.\nA:H - With CONFIG_LIST_HARDENED/DEBUG_LIST, the first list_del_init() on the doubly linked rlist BUGs. Without it, the walk faults or loops on the corrupted reco list. The server can resend bad frames after every reconnect, so it can keep retrying until the client host crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:15:05.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83"
        },
        {
          "url": "https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da"
        },
        {
          "url": "https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"
        }
      ],
      "title": "smb: client: fix rlist race and missing initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98174",
    "datePublished": "2026-10-06T08:44:18.350Z",
    "dateReserved": "2026-09-25T10:25:14.322Z",
    "dateUpdated": "2026-10-19T09:15:05.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.