---
id: CVE-2024-56729
title: 'smb: Initialize cfid->tcon before performing network ops'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: Initialize cfid->tcon before performing network ops

  Avoid leaking a tcon ref when a lease break races with opening the
  cached directory. Processing the leak break…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    269ff24a5b2b58600151e04e964d2043bfe1843c
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    625e2357c8fcfae6e66dcc667dc656fe390bab15
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    4b216c8f9c7d84ef7de33ca60b97e08e03ef3292
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262
  - >-
    Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 <
    c353ee4fb119a2582d0e011f66a76a38f5cf984d
  - Linux 6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T19:57:47.963578Z'
published: '2024-12-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:20:27.814Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-56729'
references:
  - url: 'https://git.kernel.org/stable/c/269ff24a5b2b58600151e04e964d2043bfe1843c'
  - url: 'https://git.kernel.org/stable/c/625e2357c8fcfae6e66dcc667dc656fe390bab15'
  - url: 'https://git.kernel.org/stable/c/4b216c8f9c7d84ef7de33ca60b97e08e03ef3292'
  - url: 'https://git.kernel.org/stable/c/1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262'
  - url: 'https://git.kernel.org/stable/c/c353ee4fb119a2582d0e011f66a76a38f5cf984d'
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.09774
ingestedAt: '2026-11-03T15:48:07.691Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: Initialize cfid->tcon before performing network ops

Avoid leaking a tcon ref when a lease break races with opening the
cached directory. Processing the leak break might take a reference to
the tcon in cached_dir_lease_break() and then fail to release the ref in
cached_dir_offload_close, since cfid->tcon is still NULL.

## Affected

- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 269ff24a5b2b58600151e04e964d2043bfe1843c`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 625e2357c8fcfae6e66dcc667dc656fe390bab15`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 4b216c8f9c7d84ef7de33ca60b97e08e03ef3292`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < 1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262`
- `Linux >= ebe98f1447bbccf8228335c62d86af02a0ed23f7 < c353ee4fb119a2582d0e011f66a76a38f5cf984d`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.