CVE-2024-35869

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35869", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.108Z", "datePublished": "2024-05-19T08:34:27.645Z", "dateUpdated": "2026-08-05T11:30:31.558Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:31.558Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: guarantee refcounted children from parent session\n\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon->ses are also refcounted. They're all needed across\nthe entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at\nit, too."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable refcounting is driven entirely by DFS referral responses from a remote SMB peer \u2014 the server chooses the nesting depth, target types, interlink/storage flags, and referral TTL that produce the unbalanced `dfs_root_ses` chain. A malicious/compromised SMB server, an SMB MITM, or an attacker controlling DNS for DFS target hostnames reaches this over the network.\nAC:L - This is a deterministic refcount imbalance, not a race: the server simply returns a referral topology three or more levels deep (limit is MAX_NESTED_LINKS=8) and can force the failover/reconnect path arbitrarily often by dropping TCP or setting a short TTL. Heap grooming for the subsequent UAF is routine and fully under attacker control.\nPR:N - The remote server holds no privileges on the victim host \u2014 CIFS authenticates the client to the server, not the reverse, so nothing gates the referral data on the way to the vulnerable code. The runtime `dfs_cache_refresh()` worker and DFS failover run in kernel context with no local account required at all; even the local automount path (`cifs_d_automount`) has no capability check.\nUI:N - Once a normal cifs DFS mount exists (fstab/autofs, standing configuration, not a per-exploit action), the server triggers the vulnerable failover and `dfs_cache_work` refresh paths on its own schedule with no victim participation. The automount path is likewise reached by ordinary directory traversal, not a deliberate security decision.\nS:U - The corrupted `struct cifs_ses` objects and the resulting control-flow hijack are confined to the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of `struct cifs_ses`, which is dereferenced for `ses->server`, `ses->tcon_ipc`, `ses->Suid` and holds SMB credentials and signing/session keys; reclaiming the freed slab object yields an arbitrary-read primitive and leaks sensitive session material.\nI:H - The DFS failover path performs `server->ops->tree_connect(...)` \u2014 an indirect call through a function pointer read out of the freed session's `server` field \u2014 giving a direct control-flow hijack primitive once the object is reclaimed with attacker-groomed heap data.\nA:H - Dereferencing and spin-locking a freed `struct cifs_ses` from the reconnect path and the `dfs_cache_refresh` workqueue causes kernel oops/panic, and the double-put on the mount error path corrupts the session list. The server can trigger it repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "versions": [{"version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "lessThan": "645f332c6b63499cc76197f9b6bffcc659ba64cc", "status": "affected", "versionType": "git"}, {"version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "lessThan": "e1db9ae87b7148c021daee1fcc4bc71b2ac58a79", "status": "affected", "versionType": "git"}, {"version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "lessThan": "062a7f0ff46eb57aff526897bd2bebfdb1d3046a", "status": "affected", "versionType": "git"}, {"version": "f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6", "status": "affected", "versionType": "git"}, {"version": "c082c3be0f96e759ff2e361d929832fda0b93851", "status": "affected", "versionType": "git"}, {"version": "6.2.15", "lessThan": "6.3", "status": "affected", "versionType": "semver"}, {"version": "6.3.2", "lessThan": "6.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"}], "title": "smb: client: guarantee refcounted children from parent session", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "645f332c6b63", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "e1db9ae87b71", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "062a7f0ff46e", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.6.29", "status": "unaffected", "lessThanOrEqual": "6.6.*", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.8.5", "status": "unaffected", "lessThanOrEqual": "6.8.*", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.9", "status": "unaffected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-24T15:01:40.323674Z", "id": "CVE-2024-35869", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T21:16:06.861Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.968Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.968Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-24T15:01:40.323674Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "645f332c6b63 ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "e1db9ae87b71 ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "062a7f0ff46e ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.6.29", "versionType": "custom", "lessThanOrEqual": "6.6.*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": " 6.8.5", "versionType": "custom", "lessThanOrEqual": "6.8.* "}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.9"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-24T15:08:25.313Z"}}], "cna": {"title": "smb: client: guarantee refcounted children from parent session", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable refcounting is driven entirely by DFS referral responses from a remote SMB peer \u2014 the server chooses the nesting depth, target types, interlink/storage flags, and referral TTL that produce the unbalanced `dfs_root_ses` chain. A malicious/compromised SMB server, an SMB MITM, or an attacker controlling DNS for DFS target hostnames reaches this over the network.\nAC:L - This is a deterministic refcount imbalance, not a race: the server simply returns a referral topology three or more levels deep (limit is MAX_NESTED_LINKS=8) and can force the failover/reconnect path arbitrarily often by dropping TCP or setting a short TTL. Heap grooming for the subsequent UAF is routine and fully under attacker control.\nPR:N - The remote server holds no privileges on the victim host \u2014 CIFS authenticates the client to the server, not the reverse, so nothing gates the referral data on the way to the vulnerable code. The runtime `dfs_cache_refresh()` worker and DFS failover run in kernel context with no local account required at all; even the local automount path (`cifs_d_automount`) has no capability check.\nUI:N - Once a normal cifs DFS mount exists (fstab/autofs, standing configuration, not a per-exploit action), the server triggers the vulnerable failover and `dfs_cache_work` refresh paths on its own schedule with no victim participation. The automount path is likewise reached by ordinary directory traversal, not a deliberate security decision.\nS:U - The corrupted `struct cifs_ses` objects and the resulting control-flow hijack are confined to the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of `struct cifs_ses`, which is dereferenced for `ses->server`, `ses->tcon_ipc`, `ses->Suid` and holds SMB credentials and signing/session keys; reclaiming the freed slab object yields an arbitrary-read primitive and leaks sensitive session material.\nI:H - The DFS failover path performs `server->ops->tree_connect(...)` \u2014 an indirect call through a function pointer read out of the freed session's `server` field \u2014 giving a direct control-flow hijack primitive once the object is reclaimed with attacker-groomed heap data.\nA:H - Dereferencing and spin-locking a freed `struct cifs_ses` from the reconnect path and the `dfs_cache_refresh` workqueue causes kernel oops/panic, and the double-put on the mount error path corrupts the session list. The server can trigger it repeatedly."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "lessThan": "645f332c6b63499cc76197f9b6bffcc659ba64cc", "versionType": "git"}, {"status": "affected", "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "lessThan": "e1db9ae87b7148c021daee1fcc4bc71b2ac58a79", "versionType": "git"}, {"status": "affected", "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "lessThan": "062a7f0ff46eb57aff526897bd2bebfdb1d3046a", "versionType": "git"}, {"status": "affected", "version": "f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6", "versionType": "git"}, {"status": "affected", "version": "c082c3be0f96e759ff2e361d929832fda0b93851", "versionType": "git"}, {"status": "affected", "version": "6.2.15", "lessThan": "6.3", "versionType": "semver"}, {"status": "affected", "version": "6.3.2", "lessThan": "6.4", "versionType": "semver"}], "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.29", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: guarantee refcounted children from parent session\n\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon->ses are also refcounted. They're all needed across\nthe entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at\nit, too."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.29", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.2.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.3.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:31.558Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35869", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:30:31.558Z", "dateReserved": "2024-05-17T13:50:33.108Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T08:34:27.645Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "645f332c6b63499cc76197f9b6bffcc659ba64cc", "status": "affected", "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "versionType": "git"}, {"lessThan": "e1db9ae87b7148c021daee1fcc4bc71b2ac58a79", "status": "affected", "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "versionType": "git"}, {"lessThan": "062a7f0ff46eb57aff526897bd2bebfdb1d3046a", "status": "affected", "version": "8e3554150d6c80a84b3cb046615d1a0e943811dc", "versionType": "git"}, {"status": "affected", "version": "f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6", "versionType": "git"}, {"status": "affected", "version": "c082c3be0f96e759ff2e361d929832fda0b93851", "versionType": "git"}, {"lessThan": "6.3", "status": "affected", "version": "6.2.15", "versionType": "semver"}, {"lessThan": "6.4", "status": "affected", "version": "6.3.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.29", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "645f332c6b63", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "e1db9ae87b71", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "062a7f0ff46e", "status": "affected", "version": "1da177e4c3f4", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.29", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.9"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "965D00B8-87E5-460E-A89A-5F5DF119D845", "versionEndExcluding": "6.3", "versionStartIncluding": "6.2.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA36A678-0133-4EFB-B4BE-29C569825E2D", "versionEndExcluding": "6.6.29", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: guarantee refcounted children from parent session\n\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon->ses are also refcounted. They're all needed across\nthe entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at\nit, too."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: garantiza que los hijos recontados desde la sesi\u00f3n principal Evite posibles errores de use after free al recorrer referencias DFS, montar y realizar la conmutaci\u00f3n por error de DFS asegur\u00e1ndose de que todos los hijos del padre @tcon- >ses tambi\u00e9n se cuentan nuevamente. Todos son necesarios en todo el montaje DFS. Deshazte de @tcon->dfs_ses_list mientras estamos en eso tambi\u00e9n."}], "id": "CVE-2024-35869", "lastModified": "2026-08-04T11:18:03.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35869", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-24T15:01:40.323674Z", "version": "2.0.3"}}]}, "published": "2024-05-19T09:15:08.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: smb: client: guarantee refcounted children from parent session", "id": "2281742", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281742"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: guarantee refcounted children from parent session\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon->ses are also refcounted. They're all needed across\nthe entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at\nit, too.", "The following vulnerability has been resolved in the Linux kernel: smb: client: Fix - Guarantee refcounted children from the parent session."], "name": "CVE-2024-35869", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35869\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35869\nhttps://lore.kernel.org/linux-cve-announce/2024051940-CVE-2024-35869-73f8@gregkh/T"], "threat_severity": "Moderate"}

{}