Review reviewCritical

CVE-2024-35865

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

CVSS: 9.8
EPSS: 0.63%
CISA KEV: Not listed
Published: 2024.05.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.63%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 7f48558e6489d032b1584b0cc9ac4bb11072c034 < a710ef9e974f18232d2b9b19c90eda1a1167b2d4, >= 7f48558e6489d032b1584b0cc9ac4bb11072c034 < 84488466b7a69570bdbf76dd9576847ab97d54e7, >= 7f48558e6489d032b1584b0cc9ac4bb11072c034 < 21fed37d2bdcde33453faf61d3d4d96c355f04bd, >= 7f48558e6489d032b1584b0cc9ac4bb11072c034 < 3dba0e5276f131e36d6d8043191d856f49238628, >= 7f48558e6489d032b1584b0cc9ac4bb11072c034 < 22863485a4626ec6ecf297f4cc0aef709bc862e4, >= a67172a013953664b1dad03c648200c70b90506c, >= 3.12.48 < 3.13, >= 3.13, < 6.1.85, >= 6.2 < 6.6.26, >= 6.7 < 6.8.5, 6.9
Fixed versions: 6.1.85, 6.6.26, 6.8.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416