CVE-2026-89636

The Linux kernel's SMB/CIFS client contains a use-after-free in its DFS (distributed file system) referral target cache: free_tgts() frees every entry in ce->tlist but fails to clear the ce->tgthint pointer, leaving it pointing at freed cache_dfs_tgt memory. If that hint is dereferenced afterwards (for example, when a DFS referral cache entry is torn down and the stale hint is consulted), the kernel accesses freed memory, which can corrupt heap memory and lead to a crash or potential local privilege escalation. The flaw is reached through the kernel SMB client's DFS referral handling, so systems that mount or access SMB shares with DFS referrals — common in enterprise/domain file-server environments — represent the practical exposure. It is scored 9.8 (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but the trigger path requires the affected system to perform DFS referral resolution rather than arbitrary remote access. It is not in CISA's KEV and no public proof-of-concept exists, so no exploitation is currently known.

What to do: Apply distribution kernel updates as soon as stable backports carrying the free_tgts() fix are released. Inventory and prioritize systems that mount SMB/CIFS shares with DFS referrals (look for cifs.ko usage and DFS referral resolution), since those are the practically exposed hosts. As hardening, avoid mounting SMB shares from untrusted servers and consider blacklisting the cifs kernel module on hosts that do not need it.