CVE-2026-74608

A flaw was found in the Server Message Block (SMB) client of the Linux kernel. A use-after-free vulnerability exists in the cifs_try_adding_channels() function. This occurs when a concurrent interface list refresh removes a reference to an interface while a channel creation is in progress and fails, leading to the system attempting to access memory that has already been freed. This could result in a denial of service or potentially lead to arbitrary code execution.

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access, specific SMB multichannel session establishment, and winning a narrow race condition between channel creation failure and network interface refreshes. In typical Red Hat Enterprise Linux environments, CIFS multichannel functionality is not enabled by default, significantly limiting exposure. An attacker with appropriate local access could leverage this race condition to induce kernel memory corruption or trigger a system denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.