CVE-2026-98175

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: cancel reconnect work in clean_demultiplex_info()

clean_demultiplex_info() cancels server->echo delayed work but not

server->reconnect, which can cause a use-after-free when the

demultiplex thread exits while a reconnect work is still queued:

cifs_demultiplex_thread()

cifs_readv_from_socket()

cifs_reconnect()

__cifs_reconnect()

cifs_queue_server_reconn()

mod_delayed_work(cifsiod_wq, &server->reconnect, 0)

clean_demultiplex_info()

cancel_delayed_work_sync(&server->echo) // echo canceled

// reconnect NOT canceled

kfree_sensitive(server) // server freed

...later, on cifsiod_wq:

smb2_reconnect_server()

server->srv_count // UAF read of freed server

Fix this by canceling server->reconnect delayed work in

clean_demultiplex_info() before the server is freed, the same way

ci

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References