CVE-2026-97562— smb: client: pin DFS superblock in iterator callback
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： smb: 客户端：在迭代器回调中固定 DFS 超级块 存储了一个原始的超级块指针，但 只有在 释放 并递减其被动引用计数后，才会获取该超级块的活跃引用。因此，在 使用该超级块之前，并发的 DFS 自动卸载过期机制可能会提前释放该超级块。 一个确定性的 KASAN 测试重现了该竞态条件，表现为： BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 应用本修复后，同一测试用例通过。 本修复方案在 仍持有共享锁
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | bacd704a95ad0b93af995aae4a523aa046f46563< 3c9acc9835c304013a4faeb969fe9333d66ca9f8 |
affected |
bacd704a95ad0b93af995aae4a523aa046f46563< ea43a15cea36dc5ddd832be5bddeac7dd804cbcf |
affected | ||
bacd704a95ad0b93af995aae4a523aa046f46563< a6b6561522212af852c9ad8a7dca8d59ef2c7377 |
affected | ||
bacd704a95ad0b93af995aae4a523aa046f46563< 5b01a8c0209690db75341528ec53fd87e0ac1460 |
affected | ||
bacd704a95ad0b93af995aae4a523aa046f46563< d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 |
affected | ||
5.7 |
affected | ||
< 5.7 |
unaffected | ||
6.6.158≤ 6.6.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97562
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
smb: client: pin DFS superblock in iterator callback
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: pin DFS superblock in iterator callback
tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super()
takes its active reference only after iterate_supers_type() has dropped
s_umount and its passive reference. Concurrent DFS automount expiry can
therefore free the superblock before cifs_sb_active() uses it.
A deterministic KASAN test reproduces the race as:
BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80
The same test passes with this change applied.
Take the active reference in the callback while iterate_supers_type()
still holds s_umount shared. cifs_put_tcp_super() remains the matching
release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-97562
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97562
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-97562 (5)
Same Patch Batch · Linux · 2026-09-25 · 372 CVEs total
| CVE-2026-100075 | 9.8 CRITICAL | RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters |
| CVE-2026-97957 | 8.8 HIGH | net: hinic: fix mailbox segment buffer overflow |
| CVE-2026-97527 | 8.8 HIGH | scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock |
| CVE-2026-97528 | 8.8 HIGH | scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error |
| CVE-2026-97555 | 8.8 HIGH | smb: client: fix heap overflow in DACL owner/group rewrite |
| CVE-2026-98115 | 8.8 HIGH | ksmbd: safely drain sessions during logoff |
| CVE-2026-97525 | 8.2 HIGH | x86/mm/pat: Allocate split page tables as kernel page tables |
| CVE-2026-98130 | 8.1 HIGH | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START |
| CVE-2026-97573 | 8.1 HIGH | bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() |
| CVE-2026-98069 | 8.1 HIGH | net/rds: acquire the fastpath locks in rds_conn_shutdown() |
| CVE-2026-98070 | 8.1 HIGH | net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() |
| CVE-2026-97570 | 8.1 HIGH | bnxt_en: Bound SW TPA IDs to prevent crashes |
| CVE-2026-97911 | 7.8 HIGH | accel: ethosu: Ensure SRAM region size matches job |
| CVE-2026-98023 | 7.8 HIGH | vxlan: reject dynamic fdb entries that reference a nexthop id |
| CVE-2026-97910 | 7.8 HIGH | ASoC: sprd: validate compress buffer sizes against fixed allocations |
| CVE-2026-98143 | 7.8 HIGH | accel: ethosu: Don't read the U65 rounding mode as a storage mode |
| CVE-2026-97903 | 7.8 HIGH | exit: hold a reference to thread_pid across proc_flush_pid |
| CVE-2026-97548 | 7.8 HIGH | xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions |
| CVE-2026-97594 | 7.8 HIGH | landlock: Fix use-after-free of the source's parent directory |
| CVE-2026-98073 | 7.8 HIGH | net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). |
Showing top 20 of 372 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-97562
No comments yet