CVE-2024-26928

smb: client: fix potential UAF in cifs_debug_files_proc_show()

HIGH

7.8

CVSS Score

Published: April 28, 2024 at 11:28 AM UTC

Updated: June 17, 2026 at 07:18 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

4.20 ≤ v < 5.10.2374.20 ≤ v < 5.15.1804.20 ≤ v < 6.1.854.20 ≤ v < 6.6.264.20 ≤ v < 6.8.54.20 ≤ v < 6.95.11 ≤ v < 5.15.1805.16 ≤ v < 6.1.856.2 ≤ v < 6.6.266.7 ≤ v < 6.8.56.9 rc1 6.9 rc2dfe33f9abc08997e56f9bdf14fe9ac7ac0e14075

Vendor states this is fixed in 229042314602db62559ecacba127067c22ee7b88 (fixed)

Vendor states this is fixed in 3402faf78b2516b0af1259baff50cc8453ef0bd1 (fixed)

Vendor states this is fixed in 8f8718afd446cd4ea3b62bacc3eec09f8aae85ee (fixed)

Vendor states this is fixed in a140224bcf87eb98a87b67ff4c6826c57e47b704 (fixed)

Vendor states this is fixed in a65f2b56334ba4dc30bd5ee9ce5b2691b973344d (fixed)

Vendor states this is fixed in ca545b7f0823f19db0f1148d59bc5e1a56634502 (fixed)

Vendor states this is fixed in 4.20 (unaffected)

Vendor states this is fixed in 5.10.237 (unaffected)

Vendor states this is fixed in 5.15.180 (unaffected)

Vendor states this is fixed in 6.1.85 (unaffected)

Vendor states this is fixed in 6.6.26 (unaffected)

Vendor states this is fixed in 6.8.5 (unaffected)