CVE-2024-35863

A use-after-free flaw was found in the Linux kernel in smb is_valid_oplock_break() when exiting a session. This flaw allows a local attacker to crash the system.

This vulnerability is rated as having Low severity for Red Hat Enterprise Linux because the SMB client is not actively loaded or mounted by default, and unprivileged users cannot initiate SMB mounts without elevated privileges. Exploitation requires an active CIFS connection undergoing session teardown, significantly restricting opportunities for local unprivileged attackers to trigger the flaw. As a result, the practical impact is limited to a local denial of service via kernel panic on systems actively using SMB network shares.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.