CVE-2024-35870
A critical memory corruption bug in the Linux CIFS client can cause a crash or potentially allow an attacker to execute arbitrary code. The flaw occurs when the client reconnects to a server while a session is being torn down, leading to a use‑after‑free. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.9 and earlier, especially systems that mount Windows or Samba shares using the CIFS/SMB client.
Real-world impact
An attacker could crash the kernel or potentially gain arbitrary code execution on the affected system, compromising confidentiality, integrity, and availability.
Why this severity
The CVSS score of 9.8 reflects the absence of authentication requirements, the high impact on confidentiality, integrity, and availability, and the ease of exploitation via a network connection.
What to do about it
- 011. Update your Linux kernel to a version that includes the fix for CVE-2024-35870 (e.g., Linux kernel 6.9 or later).
- 022. Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- May 19, 2024 · May 19, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.