CVE-2026-97562 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and prioritize patching and updating the Linux kernel. Additionally, security teams and vulnerability management teams should review system configurations and implement compensating controls where necessary. Operators of Linux-based systems should monitor for potential issues and ensure that their systems are up-to-date with the

Why it matters

A use-after-free vulnerability in the Linux kernel's SMB client implementation can lead to a kernel crash or potentially allow an attacker to execute arbitrary code. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and prioritize patching and updating the Linux kernel.

• Potential kernel crash or instability
• Potential for arbitrary code execution
• Need for patching and updating the Linux kernel
• Importance of monitoring the Linux kernel for potential issues

Technical summary

The vulnerability occurs in the Linux kernel's SMB client implementation, specifically in the handling of DFS superblocks. A race condition can occur, allowing for a superblock to be freed before it is used. This can lead to a kernel crash or potentially allow an attacker to execute arbitrary code. The issue arises from the tcon_super_cb() function storing a raw superblock pointer while __cifs_get_super() takes an active reference after iterate_supers_type() has dropped s_umount and its passive reference. To address this, an active reference should be taken in the callback while iterate_supers_type() holds s_umount

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is up-to-date with the latest security patches
• Monitor the Linux kernel for any potential issues related to this vulnerability
• Perform a thorough review of system configurations to identify potential exposure
• Develop and implement compensating controls for exposed systems
• Conduct regular asset inventory and vulnerability assessments
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was resolved in the Linux kernel through several commits. Source references detailing these commits are provided, including fixes that ensure proper handling of superblock references and prevent the race condition. Evidence is limited to supplied source references and CVE details. Defenders should verify the Linux kernel version and apply patches as recommended by the vendor. Additional verification may be required based on specific system configurations and potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.