CVE-2026-74259

A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. A local user could trigger a null pointer dereference by unmounting a CIFS share while certain files are still being processed. This could lead to a system crash, resulting in a denial of service.

A CIFS lifetime race can occur during umount when cifsFileInfo objects are queued to fileinfo_put_wq and the asynchronous final put runs after CIFS superblock teardown has already progressed. The observed failure is a NULL pointer dereference in the dput and list_lru_add path, causing a kernel crash and local denial of service. The bug is not directly network reachable because the trigger is the local mount and umount control path, although the reproducer depends on a CIFS network mount and a network disruption. For the CVSS the PR:L is used for the paranoid score because practical triggering may be possible for a reduced capability root, container root, or service account that can mount and unmount CIFS and affect the network path. Impact is at least local denial of service and in worst case may allow limited confidentiality or integrity impact due to lifetime race and UAF style behavior, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.