CVE-2026-74608 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, users of Linux-based systems, and organizations that rely on Linux-based infrastructure for critical operations or services. These stakeholders should be aware of the vulnerability and take proactive steps to verify and apply patches, as well as monitor system logs for potential exploitation attempts. Additionally, security teams and vulnerability management teams should prioritize

Why it matters

A use-after-free vulnerability in the Linux kernel's SMB client implementation could lead to denial of service, elevation of privileges, or data corruption. Linux kernel developers, maintainers, and users should verify and apply patches to mitigate the vulnerability.

• Potential denial of service (DoS) due to use-after-free error
• Potential elevation of privileges due to use-after-free error
• Potential data corruption or loss due to use-after-free error
• Verification of Linux kernel version and patch application is required

Technical summary

The vulnerability occurs in the `cifs_try_adding_channels()` function, where a temporary reference to an interface is taken before dropping the `iface_lock`. If `cifs_ses_add_channel()` fails, the reference is dropped and `iface->weight_fulfilled` is incremented. However, a concurrent interface list refresh can remove the list reference while channel creation is in progress, causing the last reference to be released and the interface to be freed. Subsequent access to `weight_fulfilled` then accesses freed memory.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of system configurations and network architecture to identify potential vulnerabilities
• Implement compensating controls, such as firewalls or intrusion detection systems, to mitigate potential attacks
• Conduct regular security audits and vulnerability assessments to identify and address potential weaknesses
• Track and analyze system logs to detect and respond to potential security incidents

Evidence notes

The vulnerability is caused by a use-after-free error in the `cifs_try_adding_channels()` function. The function takes a temporary reference to an interface before dropping the `iface_lock`. If `cifs_ses_add_channel()` fails, the reference is dropped and `iface->weight_fulfilled` is incremented. However, a concurrent interface list refresh can remove the list reference while channel creation is in progress, causing the last reference to be released and the interface to be freed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.