CVE-2024-35864
A vulnerability in the Linux kernel's SMB client component could lead to a 'use-after-free' error. This occurs when the system attempts to use memory that has already been released, specifically during the teardown of SMB2 sessions.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Linux kernel version 6.9 or affected versions of the Linux kernel.
Real-world impact
An attacker could potentially cause a system crash or execute arbitrary code on the machine by exploiting how the kernel manages memory during network session closures.
Why this severity
The critical score reflects that this vulnerability can be exploited remotely over a network without requiring user interaction or special privileges, potentially leading to a total loss of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for smb2_is_valid_lease_break().
NVD-referenced vendor advisory
Timeline
- May 19, 2024 · May 19, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.