CVE-2026-74608 Overview
CVE-2026-74608 is a use-after-free vulnerability in the Linux kernel's SMB client code, specifically in the cifs_try_adding_channels() function within the CIFS module. The flaw occurs during multichannel SMB session setup when a concurrent interface list refresh races with channel creation. When cifs_ses_add_channel() fails, the failure path drops the final reference to the interface structure and then updates iface->weight_fulfilled, dereferencing freed memory.
Critical Impact
The vulnerability can lead to kernel memory corruption, potential privilege escalation, or denial of service on Linux systems mounting SMB shares with multichannel enabled.
Affected Products
- Linux kernel SMB client (cifs / smb module)
- Distributions shipping vulnerable stable kernel branches prior to the fix commits
- Systems using CIFS/SMB multichannel functionality
Discovery Timeline
- 2026-08-22 - CVE-2026-74608 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74608
Vulnerability Analysis
The defect resides in the CIFS client channel management logic. cifs_try_adding_channels() iterates through available network interfaces to establish additional SMB channels. To operate on an interface without holding iface_lock during the potentially blocking channel creation, the function takes a temporary kref reference on the interface and drops the lock.
If cifs_ses_add_channel() returns an error, the current failure path first drops the temporary reference through kref_put() and then attempts to update the iface->weight_fulfilled counter. A concurrent interface list refresh can remove the list-held reference in parallel. When both references are dropped, the interface structure is freed, and the subsequent write to weight_fulfilled operates on released memory.
Root Cause
The root cause is incorrect ordering of reference-count operations relative to a field update [CWE-416]. Because two paths hold references to the interface object, freeing can occur immediately after the last kref_put(). Writing weight_fulfilled after releasing the temporary reference violates the object lifetime contract.
Attack Vector
Exploitation requires triggering the race between channel creation and interface list refresh on a system with active SMB multichannel mounts. An attacker with the ability to induce network interface changes, control an SMB server the client connects to, or influence CIFS session state may provoke the failure path in cifs_ses_add_channel() while a refresh runs. Successful exploitation corrupts kernel memory, which can be leveraged for denial of service or, with additional primitives, memory disclosure or code execution in kernel context.
See the upstream fixes for technical details: Linux Kernel Commit 1305ead, Linux Kernel Commit 1ffacba, and Linux Kernel Commit 47dfac4.
Detection Methods for CVE-2026-74608
Indicators of Compromise
- Kernel panics or oops entries referencing cifs_try_adding_channels, cifs_ses_add_channel, or kref_put in the CIFS module.
- KASAN reports flagging use-after-free access on interface structures within the smb/cifs subsystem.
- Unexpected termination or hang of processes performing SMB mounts with multichannel enabled.
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free access patterns during SMB multichannel workloads.
- Monitor dmesg and journal logs for CIFS-related BUG, WARN, or oops traces on hosts mounting SMB shares.
- Audit running kernel versions against the fixed stable releases identified in the upstream commits.
Monitoring Recommendations
- Track SMB client mount options across the fleet to identify hosts using multichannel.
- Alert on repeated CIFS session reconnection or interface refresh events, which increase race exposure.
- Correlate kernel crash telemetry with SMB workload activity to identify probable exploitation attempts.
How to Mitigate CVE-2026-74608
Immediate Actions Required
- Update affected Linux kernels to a stable release containing the upstream fix commits referenced by this CVE.
- Prioritize patching hosts that mount SMB shares with multichannel enabled or that connect to untrusted SMB servers.
- Reboot systems after kernel update to activate the patched CIFS module.
Patch Information
The fix reorders the reference-count operations so that iface->weight_fulfilled is incremented before the temporary kref_put() is called, keeping the interface object alive for the final field access. The fix is available in multiple stable branches through the following upstream commits: Linux Kernel Commit 1305ead, Linux Kernel Commit 1ffacba, Linux Kernel Commit 47dfac4, Linux Kernel Commit 4986410, Linux Kernel Commit 64d7584, and Linux Kernel Commit c292d46.
Workarounds
- Disable SMB multichannel on affected clients by remounting shares without the multichannel option until the kernel is patched.
- Restrict SMB client connectivity to trusted servers and networks to reduce attacker influence over session state.
- Limit privileged access to network configuration interfaces that can trigger CIFS interface refresh operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
