High 7.5Published Oct 6, 2026

CVE-2026-98175smb: client: cancel reconnect work in clean_demultiplex_info()

Updated under an hour ago (Oct 27, 2026, 2:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.33%, higher than 24% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued: cifs_demultiplex_thread() cifs_readv_from_socket() cifs_reconnect() __cifs_reconnect() cifs_queue_server_reconn() mod_delayed_work(cifsiod_wq, &server->reconnect, 0) clean_demultiplex_info() cancel_delayed_work_sync(&server->echo) // echo canceled // reconnect NOT canceled kfree_sensitive(server) // server freed ...later, on cifsiod_wq: smb2_reconnect_server() server->srv_count // UAF read of freed server Fix this by canceling server->reconnect delayed work in clean_demultiplex_info() before the server is freed, the same way cifs_put_tcp_session() already does.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.33% (percentile 24)
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before 180380272f116dbd2b0354c5c7872e112e519149; from 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before e3f6a779433d13aafb5edab59e4f9313051e8a52; 53e0e11efe9289535b060a51d4cf37c25e0d0f2b builds before 7ab9ceedd860216fb97f2d8574cbe58b8906f42a; 53e0e11efe9289535b060a51d4cf37c25e0d0f2b builds before 2e5103e11a17c274715dd56cf185eeedccf686b8; from 53e0e11efe9289535b060a51d4cf37c25e0d0f2b before c65eae6f61d1778ff7a82e4aae4080e26f486af1; e008a962311a875a828cbae54b43285858aaa6c8; 123b228a09b90b50b0a9d6eb8294cf0c42efc029; 0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9; and 13 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149
https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52
https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a
https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8
https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.