---
id: CVE-2026-74608
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: Fix use-after-free in cifs_try_adding_channels()

  cifs_try_adding_channels() takes a temporary reference to an interface
  before dropping iface_lock
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: Fix use-after-free in cifs_try_adding_channels()

  cifs_try_adding_channels() takes a temporary reference to an interface
  before dropping iface_lock. If cif…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74608'
references:
  - url: 'https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00477
epssPercentile: 0.39471
ingestedAt: '2026-10-14T13:30:58.514Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels()

cifs_try_adding_channels() takes a temporary reference to an interface
before dropping iface_lock. If cifs_ses_add_channel() fails, it drops
that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while
channel creation is in progress. In that case, the failure-path
kref_put() releases the last reference and frees iface. Updating
weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference,
keeping iface alive for the final access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.