---
id: CVE-2026-74608
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: Fix use-after-free in cifs_try_adding_channels()

  cifs_try_adding_channels() takes a temporary reference to an interface
  before dropping iface_lock
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: Fix use-after-free in cifs_try_adding_channels()

  cifs_try_adding_channels() takes a temporary reference to an interface
  before dropping iface_lock. If cif…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cbc53148cc0946b72d62a3c53870cb22ce4ec284 <
    64d7584e62ac8cdc750455c5fdc6008fc2de4f06
  - >-
    Linux >= cff97d683a083b862a8bb24309e0f4d2d928128a <
    c292d4686f717c03e5022fc4ae7c782f39a94915
  - >-
    Linux >= 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 <
    47dfac48bce7198ad4f1a388fc8c9491f878ac3b
  - >-
    Linux >= 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 <
    1ffacbadc14530e55b8d86f7b917524f6a0fb891
  - >-
    Linux >= 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 <
    1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805
  - >-
    Linux >= 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 <
    4986410316b1ae0e63c6ce418e4eb196723626e7
  - Linux 22a6c5b3425f327e7f4c3606a72277dce82c7d83
  - Linux >= 6.1.78 < 6.1.183
  - Linux >= 6.6.17 < 6.6.152
  - Linux >= 6.7.5 < 6.8
  - Linux 6.8
published: '2026-08-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:45.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74608'
references:
  - url: 'https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00477
epssPercentile: 0.41012
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:02:11.593248Z'
ingestedAt: '2026-10-14T13:30:58.514Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels()

cifs_try_adding_channels() takes a temporary reference to an interface
before dropping iface_lock. If cifs_ses_add_channel() fails, it drops
that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while
channel creation is in progress. In that case, the failure-path
kref_put() releases the last reference and frees iface. Updating
weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference,
keeping iface alive for the final access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.