CVE-2026-98173

A flaw was found in the Linux kernel's SMB client. A race condition in multichannel connection management allows network interface structures to be freed while still in use during concurrent interface refreshes. A malicious server or an attacker triggering interface updates can exploit this use-after-free vulnerability to cause a denial of service (DoS) or potentially corrupt kernel memory.

A use after free in the SMB client multichannel path occurs because cifs_try_adding_channels can retain an unreferenced iface list entry while dropping iface_lock to open another channel. A concurrent SMB interface refresh can remove and release that entry, after which list iteration and channel selection dereference freed iface memory. A remote SMB server that can cause interface advertisements to change during SMB multichannel setup may trigger the race. For the CVSS the PR:N rating is used because the attacker needs no local account or privileges on the client beyond the ability to act as the connected SMB server or influence its server traffic. Network reachability is conditional on the client connecting to an attacker controlled or compromised SMB server. The base impact is kernel crash and denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.