CVE-2026-89636: Linux Kernel SMB Client Use-After-Free

CVE-2026-89636 Overview

CVE-2026-89636 is a use-after-free vulnerability in the Linux kernel's SMB client Distributed File System (DFS) caching logic. The flaw resides in the free_tgts() function, which frees all cache_dfs_tgt structures linked from ce->tlist but fails to clear the ce->tgthint pointer. That pointer continues to reference one of the freed structures. Subsequent code paths that dereference ce->tgthint operate on freed memory, producing a classic use-after-free condition [CWE-416]. The upstream fix sets ce->tgthint to NULL in free_tgts() after the target list is drained.

Critical Impact
Exploitation of the dangling ce->tgthint pointer can corrupt kernel memory, enabling denial of service or potential kernel-level code execution on systems mounting SMB shares over DFS.

Affected Products

Linux kernel SMB client (fs/smb/client) DFS caching subsystem
Distributions shipping kernels prior to the commits listed in the stable tree references
Systems that mount CIFS/SMB shares with DFS referrals enabled

Discovery Timeline

2026-09-11 - CVE-2026-89636 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89636

Vulnerability Analysis

The Linux kernel SMB client caches DFS referral targets in a per-entry structure that tracks candidate servers in the ce->tlist linked list. The cache entry also stores a hint pointer, ce->tgthint, that references the preferred target within that list. When free_tgts() iterates ce->tlist and releases each cache_dfs_tgt element, the hint pointer is not updated. It continues to reference memory that the allocator has reclaimed.

Any later access to ce->tgthint reads or writes freed kernel heap memory. Depending on subsequent allocations, an attacker who can influence SMB DFS interactions may groom the freed slab slot with attacker-controlled data. The result ranges from kernel panics to controlled memory corruption within kernel address space.

Root Cause

The root cause is missing pointer invalidation during resource cleanup. free_tgts() correctly walks and frees each cache_dfs_tgt element in ce->tlist but does not reset ce->tgthint, leaving a dangling reference to reclaimed slab memory. The fix explicitly assigns ce->tgthint = NULL after the list has been freed so that later consumers can detect the absence of a valid hint.

Attack Vector

The attack surface is reachable through SMB DFS client operations. A malicious or compromised SMB server that returns crafted DFS referrals, or a local trigger that repeatedly refreshes DFS cache entries, can drive the client into the vulnerable free-then-reuse sequence. Reliable exploitation requires shaping kernel slab allocations so that the freed cache_dfs_tgt slot is reoccupied before ce->tgthint is dereferenced.

No public proof-of-concept is available for CVE-2026-89636 at the time of publication. Technical details are documented in the upstream commits, including 14f60e9, 3ff9462, 5baab40, 7507bd1, 9ab46a1, and b1b741c in the Linux stable kernel git tree.

Detection Methods for CVE-2026-89636

Indicators of Compromise

Kernel oops or panic messages referencing cifs, smb, dfs_cache, or free_tgts in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free access within the CIFS/SMB DFS cache code paths
Unexpected SMB client crashes on hosts that mount DFS namespaces

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test and staging kernels to surface use-after-free access to cache_dfs_tgt structures
Audit installed kernel package versions against distribution advisories tied to the listed stable commits
Correlate SMB mount activity with kernel crash telemetry to identify hosts exercising the vulnerable DFS cache path

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a central SIEM and alert on CIFS/SMB module faults
Track outbound SMB connections to untrusted hosts and flag DFS referral responses from unexpected servers
Monitor crash-dump generation on file servers and workstations that consume DFS shares

How to Mitigate CVE-2026-89636

Immediate Actions Required

Inventory Linux hosts running SMB client code and identify those mounting DFS namespaces
Apply distribution kernel updates that incorporate the fix setting ce->tgthint = NULL in free_tgts()
Reboot patched systems to load the corrected kernel image

Patch Information

The fix is available in the upstream Linux stable tree via commits 14f60e9, 3ff9462, 5baab40, 7507bd1, 9ab46a1, and b1b741c. Reference the Kernel Git Commit 14f60e9 and the additional stable backports at Kernel Git Commit 3ff9462, Kernel Git Commit 5baab40, Kernel Git Commit 7507bd1, Kernel Git Commit 9ab46a1, and Kernel Git Commit b1b741c. Consult your distribution's security tracker for backported package versions.

Workarounds

Unmount and avoid SMB DFS shares from untrusted servers until the kernel patch is deployed
Restrict outbound SMB (TCP/445) traffic to known-good file servers using host or perimeter firewalls
Where feasible, unload the cifs kernel module on systems that do not require SMB client functionality

bash

# Verify running kernel and check for the fixed CIFS module
uname -r
modinfo cifs | grep -E 'version|filename'

# Temporarily disable the SMB client module on hosts that do not need it
sudo umount -a -t cifs
sudo modprobe -r cifs
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf