A use-after-free flaw in the Linux kernel CIFS subsystem allows local attackers to trigger memory corruption and system instability.

This is a use-after-free vulnerability within the CIFS network file system driver, triggered when deferred file close operations execute after a file system unmount. An attacker requires local access with low privileges and no user interaction.

A successful exploit can lead to a kernel panic, causing denial of service and system downtime for affected hosts. With a CVSS score of 7.8, the vulnerability poses a high risk to infrastructure reliability, potentially impacting business operations that depend on stable file system operations.

Immediate Action: Update the Linux kernel to version 6.1.175, 6.6.142, 6.12.92, or later where the deferred close handling logic is corrected.

Proactive Monitoring: Monitor system logs for kernel warnings related to generic_shutdown_super or unexpected CIFS unmount errors.

Compensating Controls: Restrict local shell access and limit user capabilities on systems utilizing CIFS mounts to mitigate the risk of local exploitation.

Public Exploit Available: No

Administrators managing systems with active CIFS file system mounts must prioritize applying the latest kernel patches. Immediate remediation is necessary to prevent potential denial of service conditions caused by kernel crashes during unmount cycles.