CVE-2026-89636

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When the free_tgts() function frees data structures, a pointer (ce->tgthint) is not properly reset, leaving it pointing to a memory location that has already been deallocated. If this pointer is subsequently used, it can lead to a use-after-free vulnerability. This could potentially allow a local attacker to cause a denial of service or escalate privileges.

A use-after-free can occur in the SMB client DFS cache because free_tgts() frees cached DFS target entries but leaves ce tgthint pointing to one of the freed cache_dfs_tgt objects. A malicious or compromised SMB DFS server, or an attacker able to influence DFS referral traffic, may be able to drive target cache refresh or cleanup paths and later cause the stale target hint to be used. For the CVSS the PR:N because the attacker can be remote and does not need a local account on the client system in the server side attack model. The base score keeps AC:H and UI:R because the client usually must be mounted or directed to the affected DFS namespace and the vulnerable state depends on DFS cache behavior. The paranoid score treats this as a network reachable kernel use-after-free with possible memory corruption impact. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.