CVE-2026-98175

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This flaw allows a malicious server or network disruption to cause a Denial of Service (DoS) or memory corruption. The issue occurs because the client fails to cancel queued reconnection tasks before freeing connection tracking resources, resulting in a use-after-free condition when the queued task subsequently accesses the freed memory.

A use after free can occur in the SMB client when clean_demultiplex_info frees a TCP_Server_Info object while delayed reconnect work remains queued on cifsiod_wq. The queued smb2_reconnect_server callback can later dereference the freed server object after a reconnect was scheduled during demultiplex thread teardown. A malicious SMB server or an attacker able to interfere with the SMB transport may trigger reconnect activity and race it with connection teardown. For the CVSS the PR:N is used because the attacker needs no local privileges on the victim after the victim has established an SMB client connection. The attack is network reachable but has AC:H because it depends on a timing sensitive race between queued work and object destruction. Impact is at least kernel denial of service. The confirmed use after free can plausibly provide limited confidentiality or integrity impact if the freed object is reused before the callback executes. SMB client connections are commonly used in enterprise or internal networks. Practical exploitation normally requires control of a configured SMB server or a network position that can disrupt the SMB connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.