CVE-2026-74608

The Linux kernel’s CIFS SMB client contains a use‑after‑free flaw (CWE‑825) in the function cifs_try_adding_channels(). When cifs_ses_add_channel() fails, a reference to the interface structure is released before weight_fulfilled is updated. If a concurrent interface list refresh removes the reference mid‑operation, the last reference is freed and the interface object is deallocated. A subsequent update of weight_fulfilled then dereferences freed memory, creating an opportunity for a malicious attacker to trigger memory corruption or potentially gain arbitrary code execution on the host. The description does not describe a demonstrated exploitation path, but the nature of the fault indicates a serious kernel memory safety violation.

Based on the description, all Linux kernel releases that contain the CIFS SMB client implementation prior to the patch commit appear to be affected. The vulnerability is not limited to a particular distribution, architecture, or kernel version, and any kernel that includes the vulnerable code, up to the point of the fix, is susceptible. This inference is drawn because the CVE description references the kernel CIFS client code without imposing specific version constraints.

The CVSS score of 9.8 identifies the flaw as critical, while the EPSS score of < 1 % indicates a very low publicly observed exploitation probability. Because use‑after‑free bugs in the kernel can lead to arbitrary code execution or denial of service, the risk remains high. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploits have been reported yet. Attacks would likely target a CIFS client that attempts to create a channel, forces a failure, and concurrently triggers an interface list refresh, which would require specific traffic patterns or conditions on the client or server side. Nonetheless, the potential impact warrants prompt remediation.