Use-after-free in Linux kernel - CVE-2026-98173
Published: October 7, 2026
Vulnerability identifier: #VU153840
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98173
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger accesses to freed kernel memory.
The vulnerability exists due to use-after-free in cifs_try_adding_channels() when adding SMB channels concurrently with a server interface refresh. A local user can trigger overlapping channel addition and interface refresh operations to trigger accesses to freed kernel memory.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98173
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1