cve.bz

CVE-2026-89636

9.8 criticalEPSS 0.7%

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

CVSS 3.1
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON