CVE-2024-35867

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in cifs_stats_proc_show()

The Linux kernel CVE team has assigned CVE-2024-35867 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051939-CVE-2024-35867-15e3@gregkh/T

This vulnerability is rated as having a Low severity impact because exploiting it requires local system access and race condition timing during active SMB client session termination. Red Hat Enterprise Linux does not configure or mount CIFS/SMB shares by default, significantly limiting exposure on typical installations. Even when CIFS client functionality is actively used, the condition is only reachable locally when reading SMB statistics while an active session is disconnecting, resulting primarily in a local system denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.