Strix
64.8K

CVE-2026-97562

HIGHCVSS 7.5/10

Last modified

CVE-2026-97562 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= bacd704a95ad0b93af995aae4a523aa046f46563, < ea43a15cea36dc5ddd832be5bddeac7dd804cbcf; >= bacd704a95ad0b93af995aae4a523aa046f46563, < a6b6561522212af852c9ad8a7dca8d59ef2c7377; >= bacd704a95ad0b93af995aae4a523aa046f46563, < 5b01a8c0209690db75341528ec53fd87e0ac1460; >= bacd704a95ad0b93af995aae4a523aa046f46563, < d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818
LinuxLinux5.7

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-97562?
In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release.
How severe is CVE-2026-97562?
CVE-2026-97562 has a CVSS score of 7.5/10 (HIGH severity).
How do I fix CVE-2026-97562?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-97562?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST