GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35862 (GCVE-0-2024-35862)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30
VLAI
Title
smb: client: fix potential UAF in smb2_is_network_name_deleted()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:41 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9e550b085206544bd03a8b1dd58a5414e9508351 , < f9414004798d9742c1af23a1d839fe6a9503751c (git)
Affected: 9e550b085206544bd03a8b1dd58a5414e9508351 , < aa582b33f94453fdeaff1e7d0aa252c505975e01 (git)
Affected: 9e550b085206544bd03a8b1dd58a5414e9508351 , < d919b6ea15ffa56fbafef4a1d92f47aeda9af645 (git)
Affected: 9e550b085206544bd03a8b1dd58a5414e9508351 , < 63981561ffd2d4987807df4126f96a11e18b0c1d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.1.85 , ≤ 6.1.* (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.581Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:41:27.598442Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:17.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9414004798d9742c1af23a1d839fe6a9503751c",
              "status": "affected",
              "version": "9e550b085206544bd03a8b1dd58a5414e9508351",
              "versionType": "git"
            },
            {
              "lessThan": "aa582b33f94453fdeaff1e7d0aa252c505975e01",
              "status": "affected",
              "version": "9e550b085206544bd03a8b1dd58a5414e9508351",
              "versionType": "git"
            },
            {
              "lessThan": "d919b6ea15ffa56fbafef4a1d92f47aeda9af645",
              "status": "affected",
              "version": "9e550b085206544bd03a8b1dd58a5414e9508351",
              "versionType": "git"
            },
            {
              "lessThan": "63981561ffd2d4987807df4126f96a11e18b0c1d",
              "status": "affected",
              "version": "9e550b085206544bd03a8b1dd58a5414e9508351",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_network_name_deleted()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable function is invoked by the CIFS demultiplex thread on every SMB2 response received over TCP/445, keyed entirely on server-supplied fields (`Status` and `Id.SyncId.TreeId`). A malicious SMB server, or an off-path/MITM attacker injecting into an unsigned SMB connection, triggers it purely with network data.\nAC:L - The remote peer controls both sides of the race: it forces the session teardown (failed reconnect/session setup drives `__cifs_put_smb_ses()`), and it holds the SES_EXITING window open for the full request timeout simply by not answering the SMB2 LOGOFF, while flooding STATUS_NETWORK_NAME_DELETED responses. The attempt is freely repeatable with no attacker-uncontrollable precondition.\nPR:N - The attacker is the remote SMB peer and needs no credentials or privileges on the target Linux client; the code path runs in the kernel demux thread before any signature validation of the response.\nUI:N - The attack works against an already-established mount \u2014 an fstab/autofs/systemd-automount or DFS-referral connection, or a file server compromised or MITM\u0027d after mount \u2014 and the server itself induces the session teardown, so no victim action is required.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free on `cifs_tcon`/`cifs_ses` gives an attacker-influenced read of freed slab contents, and `pr_warn_once(\"%s\", tcon-\u003etree_name)` walks freed heap memory into the kernel log, leaking whatever now occupies that object.\nI:H - The path writes into freed memory \u2014 `spin_lock(\u0026tcon-\u003etc_lock)` plus `tcon-\u003eneed_reconnect = true` \u2014 on an object the remote attacker selects via the controlled TreeId, giving a heap-spray-able corruption primitive leveragable for control-flow hijack.\nA:H - Dereferencing the poisoned/freed session and tcon produces a general protection fault or KASAN oops in the cifsd kernel thread (as shown in the sibling fix\u0027s trace), crashing or hanging the client with the mount unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:26.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01"
        },
        {
          "url": "https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645"
        },
        {
          "url": "https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d"
        }
      ],
      "title": "smb: client: fix potential UAF in smb2_is_network_name_deleted()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35862",
    "datePublished": "2024-05-19T08:34:21.173Z",
    "dateReserved": "2024-05-17T13:50:33.107Z",
    "dateUpdated": "2026-08-05T11:30:26.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35862",
      "date": "2026-09-17",
      "epss": "0.00662",
      "percentile": "0.50044"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.1.85\", \"matchCriteriaId\": \"B62CF0EC-6C39-4DAD-A6CC-C31C3277A460\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.26\", \"matchCriteriaId\": \"C520696A-A594-4FFC-A32D-12DA535CE911\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.5\", \"matchCriteriaId\": \"DBD6C99E-4250-4DFE-8447-FF2075939D10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix potential UAF in smb2_is_network_name_deleted()\\n\\nSkip sessions that are being teared down (status == SES_EXITING) to\\navoid UAF.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: client: corrige UAF potencial en smb2_is_network_name_deleted() Omita las sesiones que se est\\u00e1n eliminando (estado == SES_EXITING) para evitar UAF.\"}]",
      "id": "CVE-2024-35862",
      "lastModified": "2024-12-30T15:00:09.317",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-19T09:15:07.797",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-07T01:14:53.000Z",
      "cve": "CVE-2024-35862",
      "id": "msrc_CVE-2024-35862",
      "initial_release_date": "2025-09-03T22:07:06.000Z",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix potential UAF in smb2_is_network_name_deleted()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-35862.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35862\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:07.797\",\"lastModified\":\"2026-08-04T11:18:01.543\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix potential UAF in smb2_is_network_name_deleted()\\n\\nSkip sessions that are being teared down (status == SES_EXITING) to\\navoid UAF.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: client: corrige UAF potencial en smb2_is_network_name_deleted() Omita las sesiones que se est\u00e1n eliminando (estado == SES_EXITING) para evitar UAF.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2ops.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9e550b085206544bd03a8b1dd58a5414e9508351\",\"lessThan\":\"f9414004798d9742c1af23a1d839fe6a9503751c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e550b085206544bd03a8b1dd58a5414e9508351\",\"lessThan\":\"aa582b33f94453fdeaff1e7d0aa252c505975e01\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e550b085206544bd03a8b1dd58a5414e9508351\",\"lessThan\":\"d919b6ea15ffa56fbafef4a1d92f47aeda9af645\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e550b085206544bd03a8b1dd58a5414e9508351\",\"lessThan\":\"63981561ffd2d4987807df4126f96a11e18b0c1d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb2ops.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.85\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:41:27.598442Z\",\"id\":\"CVE-2024-35862\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"6.1.85\",\"matchCriteriaId\":\"87FDB7A1-8229-4EF9-82C5-4E128DDE343F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C520696A-A594-4FFC-A32D-12DA535CE911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:57+00:00",
      "cve": "CVE-2024-35862",
      "id": "CVE-2024-35862",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "98",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix potential UAF in smb2_is_network_name_deleted()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35862.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-05T00:43:59Z",
      "cve": "CVE-2024-35862",
      "id": "CVE-2024-35862",
      "initial_release_date": "2024-05-21T01:59:44Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "1133",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35862",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35862.json",
      "version": "113"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.581Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35862\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:41:27.598442Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.938Z\"}}], \"cna\": {\"title\": \"smb: client: fix potential UAF in smb2_is_network_name_deleted()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable function is invoked by the CIFS demultiplex thread on every SMB2 response received over TCP/445, keyed entirely on server-supplied fields (`Status` and `Id.SyncId.TreeId`). A malicious SMB server, or an off-path/MITM attacker injecting into an unsigned SMB connection, triggers it purely with network data.\\nAC:L - The remote peer controls both sides of the race: it forces the session teardown (failed reconnect/session setup drives `__cifs_put_smb_ses()`), and it holds the SES_EXITING window open for the full request timeout simply by not answering the SMB2 LOGOFF, while flooding STATUS_NETWORK_NAME_DELETED responses. The attempt is freely repeatable with no attacker-uncontrollable precondition.\\nPR:N - The attacker is the remote SMB peer and needs no credentials or privileges on the target Linux client; the code path runs in the kernel demux thread before any signature validation of the response.\\nUI:N - The attack works against an already-established mount \\u2014 an fstab/autofs/systemd-automount or DFS-referral connection, or a file server compromised or MITM\u0027d after mount \\u2014 and the server itself induces the session teardown, so no victim action is required.\\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Use-after-free on `cifs_tcon`/`cifs_ses` gives an attacker-influenced read of freed slab contents, and `pr_warn_once(\\\"%s\\\", tcon-\u003etree_name)` walks freed heap memory into the kernel log, leaking whatever now occupies that object.\\nI:H - The path writes into freed memory \\u2014 `spin_lock(\u0026tcon-\u003etc_lock)` plus `tcon-\u003eneed_reconnect = true` \\u2014 on an object the remote attacker selects via the controlled TreeId, giving a heap-spray-able corruption primitive leveragable for control-flow hijack.\\nA:H - Dereferencing the poisoned/freed session and tcon produces a general protection fault or KASAN oops in the cifsd kernel thread (as shown in the sibling fix\u0027s trace), crashing or hanging the client with the mount unusable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9e550b085206544bd03a8b1dd58a5414e9508351\", \"lessThan\": \"f9414004798d9742c1af23a1d839fe6a9503751c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e550b085206544bd03a8b1dd58a5414e9508351\", \"lessThan\": \"aa582b33f94453fdeaff1e7d0aa252c505975e01\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e550b085206544bd03a8b1dd58a5414e9508351\", \"lessThan\": \"d919b6ea15ffa56fbafef4a1d92f47aeda9af645\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e550b085206544bd03a8b1dd58a5414e9508351\", \"lessThan\": \"63981561ffd2d4987807df4126f96a11e18b0c1d\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/client/smb2ops.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/smb2ops.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f9414004798d9742c1af23a1d839fe6a9503751c\"}, {\"url\": \"https://git.kernel.org/stable/c/aa582b33f94453fdeaff1e7d0aa252c505975e01\"}, {\"url\": \"https://git.kernel.org/stable/c/d919b6ea15ffa56fbafef4a1d92f47aeda9af645\"}, {\"url\": \"https://git.kernel.org/stable/c/63981561ffd2d4987807df4126f96a11e18b0c1d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix potential UAF in smb2_is_network_name_deleted()\\n\\nSkip sessions that are being teared down (status == SES_EXITING) to\\navoid UAF.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:26.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35862\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:26.161Z\", \"dateReserved\": \"2024-05-17T13:50:33.107Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:21.173Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.