« Volver al listado

CVE-2026-89636

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free_tgts()

When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota crítica en kernel (AV:N, PR:N, UI:N) con use-after-free en SMB client que permite ejecución remota sin privilegios previos, exacerbada por acceso de red sin restricciones.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementFilter Network TrafficVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software Installation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89636",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "54be1f6c1c37498bba557049df646cc239fa37e3",
              "lessThan": "14f60e959b5ac813715ff72e127beb3584ddabf6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be1f6c1c37498bba557049df646cc239fa37e3",
              "lessThan": "3ff9462bb7a06d8d32a1dc02d39580b078ec9e55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be1f6c1c37498bba557049df646cc239fa37e3",
              "lessThan": "7507bd1885643d0461a6017767492450af1ce2a3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be1f6c1c37498bba557049df646cc239fa37e3",
              "lessThan": "9ab46a13798a61d9d020b01d4e57efdabe6624fa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be1f6c1c37498bba557049df646cc239fa37e3",
              "lessThan": "5baab40404a9393bcc0b7b8f1950bf2c307e0984",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54be1f6c1c37498bba557049df646cc239fa37e3",
              "lessThan": "b1b741cf8e7ce1b91d937e23decd3d3358748700",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/client/dfs_cache.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/client/dfs_cache.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:49.243",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/14f60e959b5ac813715ff72e127beb3584ddabf6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3ff9462bb7a06d8d32a1dc02d39580b078ec9e55",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clear ce->tgthint in free_tgts()\n\nWhen free_tgts() frees all structures in ce->tlist, ce->tgthint\nis left pointing to one of the freed cache_dfs_tgt structures.\n\nIf ce->tgthint is not reset before it is used later, it results\nin a use-after-free.\n\nSet ce->tgthint to NULL in free_tgts() after the elements are\nfreed to reflect that no elements remain."
    }
  ],
  "lastModified": "2026-09-14T13:19:16.797",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}