CVE-2026-43239: Linux Kernel SMB Race Condition Flaw

CVE-2026-43239 Overview

CVE-2026-43239 is a race condition in the Linux kernel SMB client. The flaw resides in the ->query_interfaces() handler used by the smb client subsystem. Two query interface work items could concurrently attempt to update the interface list, producing a classic data race on shared state. The fix serializes access by checking and updating iface_last_update while holding iface_lock. The issue affects Linux kernel builds that include the SMB client and was resolved across multiple stable branches via upstream commits.

Critical Impact
Concurrent execution of query_interfaces() work items can corrupt the SMB client interface list, leading to undefined behavior in kernel-mode SMB session handling.

Affected Products

Linux kernel SMB client (fs/smb/client)
Stable kernel branches receiving the referenced backport commits
Distributions shipping affected kernel versions prior to applying the fix

Discovery Timeline

2026-05-06 - CVE-2026-43239 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43239

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the Linux kernel SMB client. The query_interfaces() routine refreshes the list of server-side network interfaces advertised by an SMB3 server. The kernel schedules this refresh as a work item. Under specific timing, two such work items could run concurrently against the same SMB session.

Both work items read iface_last_update to determine whether a refresh is required, then proceed to mutate the interface list. Because the check and update were not performed under a single lock, both threads of execution could decide a refresh was needed and race while modifying the shared structures. The result is inconsistent interface state inside the SMB client.

Root Cause

The root cause is missing synchronization between the time-of-check on iface_last_update and the time-of-use when the interface list is rewritten. The original code relied on implicit ordering rather than explicit locking. The patch moves both the check on iface_last_update and the subsequent update inside the iface_lock critical section, eliminating the window in which two workers can both observe stale data and proceed.

Attack Vector

Triggering the race requires conditions that cause the SMB client to schedule multiple query_interfaces() works close together against the same connection. This is generally a local kernel-state issue rather than a directly attacker-controlled remote vector, though a malicious or unstable SMB server that influences interface refresh timing could increase the likelihood of the race. Consequences are limited to in-kernel state corruption of the SMB interface list and resulting undefined behavior on affected mounts.

No public proof-of-concept code is available for this issue. Refer to the upstream commits for the exact source-level changes.

Detection Methods for CVE-2026-43239

Indicators of Compromise

Kernel warnings, oopses, or list-debug splats originating from fs/smb/client interface handling on systems with active SMB mounts
Repeated or anomalous query_interfaces activity in kernel traces against a single SMB session
Unexplained SMB mount instability or session resets on hosts using cifs.ko/smb client modules

Detection Strategies

Inventory running kernel versions across Linux endpoints and servers, comparing against the fixed commits referenced in the upstream commit 6287ee and related backports
Enable kernel lock debugging (CONFIG_PROVE_LOCKING, CONFIG_DEBUG_LIST) in test environments to surface concurrency issues in the SMB client path
Correlate SMB client kernel messages with mount operations to identify hosts running unpatched kernels

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on SMB-client stack traces
Track kernel package versions via configuration management to confirm patch deployment
Monitor SMB session reconnect rates as a proxy for client-side instability tied to interface refresh logic

How to Mitigate CVE-2026-43239

Immediate Actions Required

Identify Linux hosts that mount SMB shares using the in-kernel client and prioritize them for kernel updates
Apply vendor kernel updates that incorporate the upstream fix to query_interfaces()
Reboot affected systems after kernel package upgrade so the patched module is loaded

Patch Information

The fix is available in upstream Linux via the following commits: 6287eefaf21e, 76cc4faba034, 93e8e3ee165a, ab6564f416a6, and c3c06e42e152. The patch moves the iface_last_update check and update inside iface_lock, preventing concurrent refreshes from racing. Distribution-shipped kernels should be updated through standard package channels once the backport is included.

Workarounds

Where patching is not immediately possible, reduce exposure by minimizing reliance on the in-kernel SMB client and consider user-space alternatives such as a FUSE-based SMB client for non-critical mounts
Avoid configurations that produce frequent SMB interface refreshes, for example unstable multi-channel server advertisements
Restrict SMB client connectivity to trusted servers to limit timing influence over interface refresh scheduling

bash

# Verify running kernel and installed kernel package after applying vendor update
uname -r
# Debian/Ubuntu
apt list --installed 2>/dev/null | grep -E '^linux-image'
# RHEL/CentOS/Fedora
rpm -qa | grep -E '^kernel-'
# Confirm SMB client module in use
lsmod | grep -E 'cifs|smb'