CVE-2026-97562

A flaw was found in the Linux kernel's SMB (Server Message Block) client. A race condition occurs when a Distributed File System (DFS) automount expires while the client processes active filesystem references, resulting in a use-after-free memory flaw. A local user could exploit this timing issue during automount operations to cause a system crash, resulting in a Denial of Service (DoS), or potentially execute arbitrary code.

A use-after-free flaw was found in the Linux kernel's SMB client Distributed File System (DFS) automount handling. The tcon_super_cb() iterator callback stores a raw superblock pointer, but the active reference is only acquired by __cifs_get_super() after iterate_supers_type() has dropped s_umount and its passive reference. If DFS automount expiry runs concurrently, it can free the superblock before cifs_sb_active() uses it, resulting in a kernel slab use-after-free. A local user able to trigger this timing race during DFS automount and failover operations on a system with SMB/DFS mounts could crash the kernel, causing a denial of service; arbitrary code execution is theoretically possible but no practical exploitation primitive has been demonstrated. Red Hat rates this issue as Moderate severity because exploitation requires local access to a host with existing SMB/DFS mounts and winning a narrow timing race, and the practical impact is limited to availability. This is lower than the CVE.org Important rating (7.5, network attack vector), which assumes a malicious or compromised DFS server can drive the vulnerable path remotely. The affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt, Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS versions are resolved as deferred: the upstream fix will be applied in a future product update rather than an immediate erratum. The residual risk until the fix ships is a local denial of service (kernel crash) on systems that mount SMB/DFS shares. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.