CVE-2026-98175

Executive Summary

CVE-2026-98175 is a use-after-free (UAF) vulnerability in the Linux kernel SMB/CIFS client. When the demultiplex thread exits, clean_demultiplex_info() cancels the server->echo delayed work but fails to cancel server->reconnect, allowing a queued reconnect work item to later dereference the already-freed server structure. Systems mounting remote SMB/CIFS shares and experiencing connection churn are affected; successful exploitation can cause memory corruption, kernel panic (DoS), or potentially code execution in kernel context.

Technical Analysis

The vulnerability resides in the SMB/CIFS client teardown path. The NVD description provides an explicit race/allocation-lifetime trace:

cifs_demultiplex_thread()
  cifs_readv_from_socket()
    cifs_reconnect()
      __cifs_reconnect()
        cifs_queue_server_reconn()
          mod_delayed_work(cifsiod_wq, &server->reconnect, 0)
  clean_demultiplex_info()
    cancel_delayed_work_sync(&server->echo)   // echo canceled
                                               // reconnect NOT canceled
    kfree_sensitive(server)                    // server freed

Later, on the cifsiod_wq workqueue, smb2_reconnect_server() executes and reads server->srv_count, dereferencing the freed server object. This is a classic use-after-free: the object is released with kfree_sensitive() while a delayed work item referencing it remains queued for execution.

The core defect is an asymmetric cancellation: clean_demultiplex_info() cancels the echo delayed work but neglects the reconnect delayed work. The fix mirrors the existing correct behavior in cifs_put_tcp_session(), which already cancels server->reconnect, by adding cancellation of server->reconnect in clean_demultiplex_info() before the server structure is freed.

Attack surface: the vulnerable code path is triggered on the client during SMB/CIFS session teardown, specifically when the demultiplex thread exits concurrently with a queued reconnect work. Triggering it requires control over SMB connection state (e.g., an SMB server that forces disconnects/reconnects) — a server-side attacker or a malicious/compromised SMB endpoint can induce the reconnect-queueing sequence.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None); the chain below is inferred from the vulnerability class (UAF via uncancelled delayed work) and the trace in the NVD description.

1. Reconnaissance/target identification: The attacker identifies a Linux host acting as an SMB/CIFS client that mounts a share controlled or influenced by the attacker (e.g., a malicious or compromised SMB server, or an on-path device). The SMB client is the target; the attacker must be able to influence connection stability.

2. Triggering the flaw class: The attacker causes the client's cifs_readv_from_socket() path to invoke cifs_reconnect() → __cifs_reconnect() → cifs_queue_server_reconn(), queueing server->reconnect via mod_delayed_work(). Concurrently, the demultiplex thread exits, reaching clean_demultiplex_info(). Because only server->echo is canceled and server->reconnect is not, kfree_sensitive(server) frees the server object while the reconnect work remains queued.

3. Execution of queued work on freed memory: When smb2_reconnect_server() later runs on cifsiod_wq, it reads server->srv_count from the freed allocation — a use-after-free. Depending on timing and heap grooming, the freed memory may have been reallocated, causing reads/writes through attacker-influenced data (no specific payload technique is described in the available data).

4. Post-exploitation impact: The described primitive is a UAF read on server->srv_count. UAF in kernel context can lead to kernel crash/panic (denial of service) and, with successful heap manipulation, potential further memory corruption. Specific code-execution chains are not described in the provided data.

Impact Assessment

• Confidentiality/Integrity/Availability: The provided CVSS score is N/A (no official score). Per the CVSS vector derived for this class, a UAF in kernel context is assessed as High for C/I/A, reflecting potential memory disclosure, corruption, or system instability, though this is an analyst-derived vector, not a vendor-assigned score.
• Affected systems: Linux hosts running the SMB/CIFS client (cifs module) and mounting remote shares subject to connection churn. Servers are not directly affected; the vulnerable code is client-side.
• Blast radius: Kernel-level impact can terminate all workloads on the affected host (panic) and, in a worst case involving heap manipulation, compromise the kernel. Risk is highest where SMB endpoints are untrusted or attacker-influenced.
• EPSS/CISA KEV: Not yet scored by FIRST.org; not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Linux Kernel SMB/CIFS Client Reconnect Use-After-Free (CVE-2026-98175)
id: 9f3c1a72-6b4e-4a1d-b2e7-8c0d5f2a7e91
status: experimental
description: Detects kernel traces indicating use-after-free in the SMB/CIFS client demultiplex/reconnect teardown path (CVE-2026-98175).
logsource:
  product: linux
  service: kernel
detection:
  selection_symbols:
    - 'clean_demultiplex_info'
    - 'smb2_reconnect_server'
    - 'cifs_queue_server_reconn'
    - 'cifs_reconnect'
  selection_fault:
    - 'use-after-free'
    - 'KASAN'
    - 'slab-use-after-free'
    - 'BUG: KASAN'
  condition: selection_symbols and selection_fault
falsepositives:
  - Unrelated cifs driver debugging output
level: high
tags:
  - attack.t1203
  - cve.2026.98175

YARA Rule

rule CVE_2026_98175_CIFS_UAF
{
    meta:
        description = "Detects references to the SMB/CIFS reconnect teardown use-after-free path (CVE-2026-98175) in kernel crash logs or firmware images"
        author = "Threat Intelligence"
        reference = "CVE-2026-98175"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "clean_demultiplex_info" ascii wide
        $s2 = "smb2_reconnect_server" ascii wide
        $s3 = "cifs_queue_server_reconn" ascii wide
        $s4 = "cifs_reconnect" ascii wide
        $s5 = "use-after-free" ascii wide nocase
        $s6 = "kfree_sensitive" ascii wide
    condition:
        (uint32(0) == 0x464C457F or true) and
        (2 of ($s1, $s2, $s3, $s4)) and any of ($s5, $s6)
}

Suricata IDS Rule

alert tcp any any -> any 445 (msg:"CVE-2026-98175 SMB/CIFS client reconnect teardown abuse - repeated session resets"; flow:established,to_server; content:"|FF|SMB"; depth:8; byte_test:1,&,0x80,9; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; sid:100981750; rev:1; reference:cve,2026-98175;)

Note: SMB session-reset/reconnect churn is the observable network precursor; this rule flags abnormal reconnect frequency against SMB port 445.

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and
process.name in ("dmesg", "journalctl") and
process.args : "*cifs*" and
message : ("use-after-free" or "KASAN" or "smb2_reconnect_server")

Companion kernel-log event query (EQL sequence is not required; use a log match):

any where message : ("clean_demultiplex_info" or "cifs_queue_server_reconn") and message : ("use-after-free" or "KASAN")

Splunk SPL Query

index=os_linux (source="/var/log/kern.log" OR source="/var/log/messages" OR source="/var/log/syslog")
( "clean_demultiplex_info" OR "smb2_reconnect_server" OR "cifs_queue_server_reconn" OR "cifs_reconnect" )
( "use-after-free" OR "KASAN" OR "slab-use-after-free" )
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="linux,kernel,cifs,">
  <rule id="100981" level="12">
    <decoded_as>syslog</decoded_as>
    <match>clean_demultiplex_info|smb2_reconnect_server|cifs_queue_server_reconn</match>
    <match>use-after-free|KASAN|slab-use-after-free</match>
    <description>CVE-2026-98175: SMB/CIFS client use-after-free in reconnect teardown detected</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_98175,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Avoid mounting untrusted or intermittently reachable SMB/CIFS shares from Linux clients; restrict who can control SMB endpoints.
   • Reduce exposure to attacker-induced reconnect churn by stabilizing SMB connectivity and limiting alternative server negotiation.
   • Enable KASAN on representative/QA kernels to detect the UAF and validate exposure.
   • Where SMB is not required, do not load the cifs module.

2. Patch/upgrade steps:

   • Apply the upstream kernel fix that adds cancellation of server->reconnect in clean_demultiplex_info() (mirroring cifs_put_tcp_session()). No CVE-tracked patch evidence is currently available; monitor kernel stable/LTS advisories and vendor channels for the specific commit.
   • Until a patched kernel is available, apply vendor-supplied backports if/when published.

3. Long-term hardening:

   • Adopt a kernel patch-management process to track stable/LTS releases for kernel UAF fixes.
   • Restrict SMB client mounts to trusted, network-segmented servers.
   • Deploy kernel-log monitoring (Wazuh/Elastic/Splunk) for KASAN and cifs fault signatures to catch exploitation or stability regressions.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-98175
• CWE-416 (Use After Free) — https://cwe.mitre.org/data/definitions/416.html
• Linux kernel SMB/CIFS client source tree (fs/smb/client) — https://git.kernel.org/
• MITRE ATT&CK T1203 (Exploitation for Client Execution) — https://attack.mitre.org/techniques/T1203/
• CISA KEV catalog (not listed at time of writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the provided data; no public PoC, Nuclei template, or exploit code is available.