CVE-2026-89636 - Vulnerability Details

- smb: client: clear ce->tgthint in free_tgts()

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free_tgts()

When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results
in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a use‑after‑free flaw in the SMB client: when free_tgts() frees all target list entries, the ce->tgthint pointer is left pointing to a freed cache_dfs_tgt object. If later code dereferences ce->tgthint without first resetting it to NULL, the kernel dereferences invalid memory, causing memory corruption that can lead to a crash or undefined behavior. The advisory does not confirm arbitrary code execution, but a dangling kernel‑space pointer represents a critical reliability risk.

Affected Systems

The flaw exists in all Linux kernel builds that include the SMB client code and have not yet applied the patch that sets ce->tgthint to NULL after freeing the target list. No specific version ranges are supplied in the advisory.

Risk and Exploitability

The CVSS base score of 9.8 classifies this issue as critical, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack involves sending SMB traffic that triggers the free_tgts() cleanup; however, the precise exploitation method is not detailed, so the exact feasibility remains uncertain.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`54be1f6c1c37498bba557049df646cc239fa37e3`	affected	< 14f60e959b5ac813715ff72e127beb3584ddabf6
`54be1f6c1c37498bba557049df646cc239fa37e3`	affected	< 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55
`54be1f6c1c37498bba557049df646cc239fa37e3`	affected	< 7507bd1885643d0461a6017767492450af1ce2a3
`54be1f6c1c37498bba557049df646cc239fa37e3`	affected	< 9ab46a13798a61d9d020b01d4e57efdabe6624fa
`54be1f6c1c37498bba557049df646cc239fa37e3`	affected	< 5baab40404a9393bcc0b7b8f1950bf2c307e0984
`54be1f6c1c37498bba557049df646cc239fa37e3`	affected	< b1b741cf8e7ce1b91d937e23decd3d3358748700

Linux

affected

Version	Status	Constraints
`5.0`	affected	—
`0`	unaffected	< 5.0
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[54be1f6c1c37498bba557049df646cc239fa37e3,7507bd1885643d0461a6017767492450af1ce2a3)`	affected	code_commit	—
`[54be1f6c1c37498bba557049df646cc239fa37e3,9ab46a13798a61d9d020b01d4e57efdabe6624fa)`	affected	code_commit	—
`[54be1f6c1c37498bba557049df646cc239fa37e3,5baab40404a9393bcc0b7b8f1950bf2c307e0984)`	affected	code_commit	—
`[54be1f6c1c37498bba557049df646cc239fa37e3,b1b741cf8e7ce1b91d937e23decd3d3358748700)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.0`	affected	generic	—
`[0,5.0)`	unaffected	semver	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that nullifies ce->tgthint after freeing the target list.
Disable the SMB client feature or block SMB traffic on ports 445/TCP and 445/UDP in the firewall if a patch is not yet available.
Monitor kernel logs for fatal errors related to the SMB client and set up alerts for abnormal SMB traffic patterns to detect potential exploitation attempts.

Generated by OpenCVE AI on September 15, 2026 at 22:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00701.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14f60e959b5ac813715ff72e127beb3584ddabf6
https://git.kernel.org/stable/c/3ff9462bb7a06d8d32a1dc02d39580b078ec9e55
https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984
https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3
https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa
https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700
https://nvd.nist.gov/vuln/detail/CVE-2026-89636
https://www.cve.org/CVERecord?id=CVE-2026-89636

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/14f60e959b5ac813715ff72e127beb3584ddabf6 https://git.kernel.org/stable/c/3ff9462bb7a06d8d32a1dc02d39580b078ec9e55

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89636 https://www.cve.org/CVERecord?id=CVE-2026-89636
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
Title		smb: client: clear ce->tgthint in free_tgts()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984 https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3 https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:30.283Z

Updated: 2026-09-14T12:01:41.762Z

Reserved: 2026-09-11T19:38:34.739Z

Link: CVE-2026-89636

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:49.243

Modified: 2026-09-14T13:19:16.797

Link: CVE-2026-89636

Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:30Z

Links: CVE-2026-89636 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:15:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object