CVE-2026-43239

smb: client: prevent races in ->query_interfaces()

HIGH
8.8
CVSS Score
Published: May 6, 2026 at 11:28 AM UTC
Updated: October 19, 2026 at 08:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: prevent races in ->query_interfaces() It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.19.1 ≤ v < 6.6.1286.13 ≤ v < 6.18.166.19 ≤ v < 6.19.66.7 ≤ v < 6.12.755.195.19 rc45.19 rc55.19 rc65.19 rc75.19 rc8aa45dadd34e44fcd6a9df4b395bee5b5633b4cec
Vendor states this is fixed in 6287eefaf21ec805d42f941bd368018cf397a7f5 (fixed)
Vendor states this is fixed in 76cc4faba0343c6db945b8dc75425b33d633e1b8 (fixed)
Vendor states this is fixed in 93e8e3ee165ae4609a1222b516b573837103d2c3 (fixed)
Vendor states this is fixed in ab6564f416a6eaf1199200b6100952407b438f7d (fixed)
Vendor states this is fixed in c3c06e42e1527716c54f3ad2ced6a034b5f3a489 (fixed)
Vendor states this is fixed in 5.19 (unaffected)
Vendor states this is fixed in 6.12.75 (unaffected)
Vendor states this is fixed in 6.18.16 (unaffected)
Vendor states this is fixed in 6.19.6 (unaffected)
Vendor states this is fixed in 6.6.128 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-362

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card