CVE-2026-97562

Executive Summary

CVE-2026-97562 is a use-after-free (UAF) vulnerability in the Linux kernel CIFS/SMB client, specifically in the DFS automount superblock handling path. During concurrent DFS automount expiry, a raw superblock pointer stored by the iterator callback can be freed before it is dereferenced, producing a slab-use-after-free confirmed by KASAN (cifs_sb_active+0x77/0x80). Systems that mount CIFS/SMB shares with DFS referrals and permit local unprivileged code execution are affected; successful exploitation can corrupt kernel memory and potentially yield privilege escalation or denial of service.

Technical Analysis

The vulnerability is a classic time-of-check/time-of-use (TOCTOU) / use-after-free race in the CIFS client's DFS automount lifecycle.

Mechanism, derived strictly from the NVD description:

• tcon_super_cb() is an iterator callback invoked during iterate_supers_type(). It stores a raw superblock pointer rather than taking a reference.
• The active reference is only acquired by __cifs_get_super() after iterate_supers_type() has released s_umount and its passive reference.
• Because there is a window in which the superblock holds neither the passive reference (dropped by the iterator) nor an active reference (not yet taken by __cifs_get_super()), a concurrent DFS automount expiry can free the superblock before cifs_sb_active() dereferences it.
• The result is a slab-use-after-free in cifs_sb_active(), reproduced deterministically under KASAN as BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80.
• The fix takes the active reference inside the callback while iterate_supers_type() still holds s_umount shared, eliminating the reference-free window. cifs_put_tcp_super() remains the matching release.

Attack surface: the SMB/CIFS client subsystem of the Linux kernel, exercised via DFS (Distributed File System) automount referral handling. The race is triggered when superblock iteration (via iterate_supers_type()) overlaps with DFS automount expiry on the same superblock. This is a kernel-level memory-safety issue, not a network-protocol parsing flaw per se — the trigger is the concurrent lifetime management of a kernel object.

Relevant primitives named in the description: tcon_super_cb(), __cifs_get_super(), cifs_sb_active(), cifs_put_tcp_super(), iterate_supers_type(), s_umount.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is described at the vulnerability-class level and is limited to the primitives explicitly named in the NVD description.

1. Reconnaissance / target identification. An adversary with local code execution on a Linux host identifies that the target kernel mounts CIFS/SMB shares using DFS referrals, and that a DFS automount can be forced to expire. This typically requires an SMB server (or MITM position on the SMB path) that can issue DFS referrals.

2. Triggering the race. The attacker induces a DFS automount expiry concurrently with superblock iteration. Per the description, the race window exists because tcon_super_cb() stores a raw superblock pointer while iterate_supers_type() has dropped s_umount and the passive reference, but __cifs_get_super() has not yet taken the active reference. Winning the race frees the superblock before cifs_sb_active() uses it.

3. Payload / execution method. The exploitation method is the use-after-free class: reclaiming the freed superblock slab object with attacker-controlled or attacker-influenced contents so that the dereference in cifs_sb_active() operates on attacker-influenced memory. The NVD description does not provide a specific heap-spray object, timing calibration, or memory layout primitive; those details are not available and must not be assumed.

4. Post-exploitation impact. A successful UAF in kernel context can result in memory corruption, kernel panic (DoS), or — depending on the reclaim primitive — controlled kernel memory manipulation that may support privilege escalation. The KASAN signature (slab-use-after-free in cifs_sb_active) confirms the memory-safety fault; the concrete exploitation outcome beyond corruption/DoS is not established by the data.

Because no PoC or exploit code exists publicly, treat this as a theoretical/hardening concern rather than an actively weaponized issue at time of writing.

Impact Assessment

• Confidentiality / Integrity / Availability: A use-after-free in a kernel subsystem can lead to arbitrary memory corruption. In the general UAF model this maps to high impact across C/I/A (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is a representative local, high-complexity, low-privilege vector). Note: CVSS score is officially N/A (not scored); the vector above is analyst-supplied and not vendor-ratified.
• Affected systems: Linux hosts running the CIFS/SMB client with DFS mounts. Servers, workstations, NAS gateways, and container hosts that mount SMB/DFS shares are in scope.
• Blast radius: A kernel-level UAF that triggers a panic causes denial of service on the local node and any workloads it hosts. If exploitable for memory corruption, the blast radius extends to the host kernel — affecting all tenants on a shared kernel (e.g., containers).
• Attack complexity: HIGH. The race requires concurrent DFS automount expiry aligned with superblock iteration, and typically requires an adversarial or MITM SMB/DFS referral source plus local triggering capability — reducing mass-exploitation likelihood.
• Privileges required: Local, low privilege; network positioning (SMB/DFS server or MITM) improves reliability.

Detection Guidance

Sigma Rule

title: Linux Kernel CIFS DFS Superblock Use-After-Free (KASAN)
id: 8f3a1e02-cifs-9756-4d21-9a77-cve202697562
status: experimental
description: Detects KASAN slab-use-after-free in cifs_sb_active consistent with CVE-2026-97562 race in DFS automount expiry.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97562
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - 'KASAN: slab-use-after-free'
    - 'cifs_sb_active'
    - 'BUG: KASAN'
  cifs_context:
    - 'tcon_super_cb'
    - 'iterate_supers_type'
    - 'cifs_get_super'
  condition: keywords and cifs_context
falsepositives:
  - Kernel development and KASAN fuzzing environments
level: high
tags:
  - attack.t1068
  - cve.2026.97562

YARA Rule

rule CVE_2026_97562_CIFS_DFS_UAF
{
    meta:
        description = "Detects CVE-2026-97562 CIFS DFS superblock use-after-free references in crash artifacts or logs"
        cve = "CVE-2026-97562"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $kasan = "KASAN: slab-use-after-free"
        $fn1   = "cifs_sb_active"
        $fn2   = "tcon_super_cb"
        $fn3   = "iterate_supers_type"
        $fn4   = "cifs_put_tcp_super"
        $bug   = "BUG: KASAN"
    condition:
        $kasan and $bug and ($fn1 or $fn2) and 1 of ($fn3, $fn4)
}

Suricata IDS Rule

alert smb any any -> any 445 (msg:"CVE-2026-97562 Potential CIFS DFS Referral Automount Expiry Trigger"; flow:established,to_server; content:"|ff|SMB"; depth:4; content:"DFS"; nocase; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-97562; sid:202697562; rev:1;)

Note: CVE-2026-97562 is fundamentally a local kernel race; network detection is limited to anomalous/rapid DFS referral churn on SMB port 445/139 and should be treated as a heuristic rather than a signature of the race itself.

Elastic Detection

sequence by host.id with maxspan=5s
  [process where event.category == "process" and process.name == "mount"]
  [file where (file.path like "/sys/fs/cgroup%" or file.path like "%cifs%") and file.action == "deleted"]
| where true

Alternatively, for kernel log monitoring:

logs-linux.system where message like~ "*cifs_sb_active*" or message like~ "*KASAN: slab-use-after-free*"

Splunk SPL Query

index=linux sourcetype=syslog OR sourcetype=kernel
| search ("KASAN: slab-use-after-free" OR "BUG: KASAN") AND ("cifs_sb_active" OR "tcon_super_cb" OR "iterate_supers_type")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="linux,kernel,cifs,">
  <rule id="2026975" level="12">
    <decoded_as>syslog</decoded_as>
    <match>KASAN: slab-use-after-free in cifs_sb_active</match>
    <description>CVE-2026-97562: Linux kernel CIFS DFS superblock use-after-free detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="2026976" level="10">
    <decoded_as>syslog</decoded_as>
    <match>BUG: KASAN</match>
    <regex>tcon_super_cb|iterate_supers_type|cifs_put_tcp_super</regex>
    <description>CVE-2026-97562: Potential CIFS DFS superblock race activity</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Avoid or unmount unnecessary CIFS/SMB DFS automounts on exposed or multi-tenant hosts until a fix is available.
   • Restrict SMB/DFS referral sources to trusted, hardened servers; eliminate MITM exposure on port 445/139 paths.
   • Reduce local attack surface (least privilege, no untrusted local code) to minimize potential UAF triggering.
   • Where feasible in non-production environments, run with KASAN to detect the race and monitor kernel logs for cifs_sb_active UAF signatures.

2. Patch/upgrade steps:

   • No fixed upstream commit hash or stable backport is present in the provided data. Monitor the upstream Linux kernel CIFS client tree and distro advisories (Red Hat, SUSE, Canonical, Debian) for the fix that takes the active reference inside the callback while iterate_supers_type() holds s_umount shared.
   • Once a backport lands, apply the kernel update and reboot. Verify the fix contains the change to tcon_super_cb() reference handling and matching cifs_put_tcp_super() release.

3. Long-term hardening:

   • Track kernel CIFS/SMB client CVEs and keep kernel patch cadence current.
   • Enforce segmentation so untrusted networks cannot inject or alter DFS referrals.
   • Deploy kernel memory-safety instrumentation (KASAN/KFENCE) in test rings to catch similar UAF races pre-production.
   • Maintain kernel log aggregation (Splunk/Wazuh/Elastic) tuned to KASAN and CIFS subsystem strings.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97562
• Linux kernel CIFS/SMB client source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git (fs/smb/client)
• CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/
• CISA KEV catalog (CVE-2026-97562 not listed — check status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, threat actor campaign, or exploit-in-the-wild evidence was identified in the provided data at time of writing.