CVE-2024-35861

HIGH

Linux Kernel < 6.1.85 - Use After Free

Title source: rule

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

References (4)

[Patch] https://git.kernel.org/stable/c/2cfff21732132e363b4cc275d63ea98f1af726c1

[Patch] https://git.kernel.org/stable/c/7e8360ac8774e19b0b25f44fff84a105bb2417e4

[Patch] https://git.kernel.org/stable/c/e0e50401cc3921c9eaf1b0e667db174519ea939f

[Patch] https://git.kernel.org/stable/c/f9a96a7ad1e8d25dc6662bc7552e0752de74a20d

Scores

CVSS v3 7.8

EPSS 0.0002

EPSS Percentile 3.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-416

Status published

Affected Products (6)

linux/linux_kernel < 6.1.85

linux/linux_kernel

linux/Kernel < 6.1.85linux

linux/Kernel < 6.6.26linux

linux/Kernel < 6.8.5linux

Timeline

Published May 19, 2024

Tracked Since Feb 18, 2026