Strix
64.2K

CVE-2026-89636

CRITICALCVSS 9.8/10EPSS 0.61%

Last modified

CVE-2026-89636 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.. EPSS estimates a 0.61% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.61%

47.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 54be1f6c1c37498bba557049df646cc239fa37e3, < 14f60e959b5ac813715ff72e127beb3584ddabf6; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 7507bd1885643d0461a6017767492450af1ce2a3; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 9ab46a13798a61d9d020b01d4e57efdabe6624fa; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 5baab40404a9393bcc0b7b8f1950bf2c307e0984; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < b1b741cf8e7ce1b91d937e23decd3d3358748700
LinuxLinux5.0

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89636?
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
How severe is CVE-2026-89636?
CVE-2026-89636 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.61% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89636?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89636?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST