CVE-2026-74608 (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access.

Is your site exposed to CVE-2026-74608?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0048

Probability of exploitation

0.40%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805 https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891 https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7 https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06 https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915

Frequently Asked Questions

What is CVE-2026-74608? +

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() releases the last reference and frees iface. Updating weight_fulfilled afterward then accesses freed memory. Increment weight_fulfilled before dropping the temporary reference, keeping iface alive for the final access. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-74608? +

CVE-2026-74608 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0048, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-74608? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-74608