Review reviewHigh

CVE-2024-35861

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

CVSS: 7.8
EPSS: 0.66%
CISA KEV: Not listed
Published: 2024.05.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.66%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= dca65818c80cf06e0f08ba2cf94060a5236e73c2 < 7e8360ac8774e19b0b25f44fff84a105bb2417e4, >= dca65818c80cf06e0f08ba2cf94060a5236e73c2 < 2cfff21732132e363b4cc275d63ea98f1af726c1, >= dca65818c80cf06e0f08ba2cf94060a5236e73c2 < f9a96a7ad1e8d25dc6662bc7552e0752de74a20d, >= dca65818c80cf06e0f08ba2cf94060a5236e73c2 < e0e50401cc3921c9eaf1b0e667db174519ea939f, >= dd9ccff8c8980bf9ea7f25e83eeb28154f902920, >= 5.17.2 < 5.18, >= 5.18, >= 5.17.2 < 6.1.85, >= 6.2 < 6.6.26, >= 6.7 < 6.8.5, 6.9
Fixed versions: 6.1.85, 6.6.26, 6.8.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416