CVE-2024-35869: Linux Kernel Use-After-Free Vulnerability

CVE-2024-35869 Overview

CVE-2024-35869 is a use-after-free vulnerability [CWE-416] in the Linux kernel's SMB client implementation. The flaw resides in the DFS (Distributed File System) referral handling code within the smb: client subsystem. Child sessions attached to a parent tcon->ses were not properly refcounted across the entire DFS mount lifecycle. This creates a window where memory can be accessed after it has been freed during DFS referral walking, mounting, and failover operations. The vulnerability affects Linux kernel versions including 6.9-rc1 and 6.9-rc2, and has been resolved through upstream stable kernel commits.

Critical Impact
Unauthenticated network-accessible exploitation can lead to arbitrary code execution or kernel memory corruption on systems mounting SMB/DFS shares.

Affected Products

Linux Kernel (multiple stable branches prior to fix)
Linux Kernel 6.9-rc1
Linux Kernel 6.9-rc2

Discovery Timeline

2024-05-19 - CVE-2024-35869 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-35869

Vulnerability Analysis

The vulnerability exists in the Linux kernel's CIFS/SMB client code that handles DFS referrals. When the client walks DFS referrals or performs failover, it accesses child session objects belonging to the parent tcon->ses structure. These children were not consistently reference-counted for the full duration of the DFS mount. If a child session is released while another code path still holds a pointer to it, subsequent dereferences trigger use-after-free access to kernel memory.

The fix ensures all children from the parent session are refcounted, aligning their lifetime with the DFS mount. The patch also removes the now-unneeded tcon->dfs_ses_list structure, consolidating session lifecycle management.

Root Cause

The root cause is inconsistent reference counting between parent SMB tree connections (tcon) and their associated session children. Code paths managing DFS referral traversal, mount setup, and failover did not increment refcounts on every child session they used. Concurrent teardown or reconnection logic could free a session while another path retained a stale pointer, satisfying the classic use-after-free precondition.

Attack Vector

The vulnerability is reachable over the network through a malicious or compromised SMB server presenting crafted DFS referrals. A Linux client mounting a DFS path from an attacker-controlled server can be induced into a state where the freed session memory is accessed. Successful exploitation requires no authentication or user interaction against a client that initiates the mount, and can result in kernel memory corruption, information disclosure, or code execution in kernel context. See the upstream fix commit e1db9ae for the technical resolution.

Detection Methods for CVE-2024-35869

Indicators of Compromise

Kernel oops or panic messages referencing cifs, smb2_reconnect, or DFS referral functions in dmesg and /var/log/kern.log.
Unexpected SMB client crashes or hung mount processes after connecting to untrusted DFS shares.
KASAN reports flagging use-after-free reads in the cifs.ko or smb.ko module when enabled on test systems.

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against the fixed commits listed in the stable tree references.
Audit which hosts mount SMB/CIFS shares and whether they consume DFS referrals from external or untrusted domains.
Monitor for outbound SMB (TCP 445) connections from Linux servers to unexpected destinations that could deliver malicious DFS responses.

Monitoring Recommendations

Enable kernel crash reporting (kdump, systemd-coredump) to capture faults involving the CIFS module for post-incident analysis.
Forward kernel logs to a centralized SIEM and alert on cifs or smb subsystem stack traces.
Track mount and unmount events for cifs filesystems using auditd rules on mount and umount syscalls.

How to Mitigate CVE-2024-35869

Immediate Actions Required

Upgrade the Linux kernel to a version containing the fix commits 062a7f0, 645f332, or e1db9ae from the stable tree.
Restrict SMB client connections to trusted file servers and block outbound TCP 445 to untrusted networks at the perimeter.
Unmount and avoid mounting DFS paths from untrusted SMB servers until patching is complete.

Patch Information

The vulnerability is fixed by upstream commits 062a7f0, 645f332, and e1db9ae. These commits ensure that all child sessions attached to a parent tcon->ses are refcounted for the duration of the DFS mount and remove the obsolete tcon->dfs_ses_list. Apply distribution kernel updates from Red Hat, SUSE, Ubuntu, or Debian that incorporate these commits.

Workarounds

Disable use of DFS-based SMB mounts where feasible, using direct UNC paths to specific servers instead.
Unload the cifs kernel module on Linux hosts that do not require SMB client functionality using modprobe -r cifs.
Enforce firewall policies that permit SMB traffic only to explicitly allowlisted internal file servers.

bash

# Verify current kernel version and CIFS module status
uname -r
modinfo cifs | grep -E '^(version|srcversion|filename):'

# Prevent automatic loading of the cifs module if SMB is not required
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo modprobe -r cifs