CVE-2026-89636

CriticalCVSS 9.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free_tgts()

When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 54be1f6c1c37498bba557049df646cc239fa37e3, < 14f60e959b5ac813715ff72e127beb3584ddabf6; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 7507bd1885643d0461a6017767492450af1ce2a3; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 9ab46a13798a61d9d020b01d4e57efdabe6624fa; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < 5baab40404a9393bcc0b7b8f1950bf2c307e0984; >= 54be1f6c1c37498bba557049df646cc239fa37e3, < b1b741cf8e7ce1b91d937e23decd3d3358748700
LinuxLinux5.0

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-896379.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformCVE-2026-896387.8In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/CVE-2026-896397.1In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC ciCVE-2026-89647.5Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-896407.1In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 WiCVE-2026-896417.8In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() WhenCVE-2026-89642In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache_isize_extended() in cifs_setsize() when extending CVE-2026-896439.8In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_CVE-2026-89644In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfs_dio_iomap_bCVE-2026-89645In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocCVE-2026-896467.8In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirCVE-2026-896477.5In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph_trim_dentries() if no progress possible ceph_
CVE-2026-89636: Critical severity, CVSS 9.8 | Vulnix