CVE-2026-98261

A flaw was found in the Linux kernel's Common Internet File System (CIFS) client. When a secondary communication channel is disabled or no longer supported by a remote file server, the client releases session structures from memory while continuing to access them. A malicious server can exploit this use-after-free vulnerability to cause a system crash, leading to a Denial of Service (DoS).

A use-after-free occurs in cifs_chan_skip_or_disable() because cifs_put_tcp_session() can release the final reference to a secondary channel and also drop its reference to the primary server. The function then passes the potentially freed server object to cifs_signal_cifsd_for_reconnect() and reads server primary_server, creating a concrete stale object access with possible read and write effects. A malicious or compromised SMB server may be able to reach this path by changing multichannel support after secondary channels have been established. For the CVSS the PR:N value is used because a remote SMB server does not need privileges on the affected client once the CIFS session exists. AC:H reflects the required multichannel state, channel teardown conditions, and final reference lifetime. Impact is at least remote denial of service through a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.