Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Linux kernel SMB client may crash on reconnect

CVE-2024-35870 · published 2 years ago
Summary

The Linux kernel component that handles SMB file sharing can crash if it tries to reconnect to a server while another process is shutting down the session. This could cause temporary loss of access to network shares. Updating the kernel to the latest version fixes the issue, so apply the recent security update promptly.

What to do
  • Update linux kernel to version 6.8.5.
  • Update canonical linux-aws-6.8 to version 6.8.0-1011.12~22.04.1.
  • Update canonical linux-azure-6.8 to version 6.8.0-1010.10~22.04.1.
  • Update canonical linux-nvidia-6.8 to version 6.8.0-1009.9~22.04.1.
  • Update canonical linux-oracle-6.8 to version 6.8.0-1008.8~22.04.1.
  • Update canonical linux to version 6.8.0-38.38.
  • Update canonical linux-aws to version 6.8.0-1011.12.
  • Update canonical linux-azure to version 6.8.0-1010.10.
  • Update canonical linux-gcp to version 6.8.0-1010.11.
  • Update canonical linux-gke to version 6.8.0-1006.9.
  • Update canonical linux-ibm to version 6.8.0-1008.8.
  • Update canonical linux-intel to version 6.8.0-1007.14.
  • Update canonical linux-lowlatency to version 6.8.0-38.38.1.
  • Update canonical linux-nvidia to version 6.8.0-1009.9.
  • Update canonical linux-oem-6.8 to version 6.8.0-1008.8.
  • Update canonical linux-oracle to version 6.8.0-1008.8.
  • Update canonical linux-raspi to version 6.8.0-1007.7.
  • Update canonical linux-riscv to version 6.8.0-38.38.1.
  • Update canonical linux-raspi-realtime to version 6.8.0-2006.6.
  • Update canonical linux-realtime to version 6.8.1-1004.4.
  • Update debian rootio-linux to version 5.10.247-1.root.io.42.
  • Update debian linux to version 6.1.123-1.
  • Update debian linux to version 6.8.9-1.
  • Update linux to version 5.15.0-198.208.aikido.116.
  • Update rootio-linux to version 5.15.0-198.208.aikido.116.
  • Update linux linux to version 755fe68cd4b59e1d2a2dd3286177fd4404f57fed or later.
Affected software
Ecosystem VendorProductAffected versions
Linux linux kernel >= 6.7.0, < 6.8.5
Fix: upgrade to 6.8.5
– linux linux < 755fe68cd4b59e1d2a2dd3286177fd4404f57fed
4.16
Ubuntu:Pro:FIPS:18.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS:18.04:LTS canonical linux-gcp-fips All versions
Ubuntu:Pro:20.04:LTS canonical linux All versions
Ubuntu:Pro:20.04:LTS canonical linux-aws All versions
Ubuntu:Pro:FIPS:18.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:14.04:LTS canonical linux-azure All versions
Ubuntu:Pro:16.04:LTS canonical linux-aws-hwe All versions
Ubuntu:Pro:16.04:LTS canonical linux-azure All versions
Ubuntu:Pro:16.04:LTS canonical linux-gcp All versions
Ubuntu:Pro:16.04:LTS canonical linux-hwe All versions
Ubuntu:16.04:LTS canonical linux-hwe-edge All versions
Ubuntu:Pro:16.04:LTS canonical linux-oracle All versions
Ubuntu:Pro:18.04:LTS canonical linux All versions
Ubuntu:Pro:18.04:LTS canonical linux-aws All versions
Ubuntu:18.04:LTS canonical linux-aws-5.0 All versions
Ubuntu:18.04:LTS canonical linux-aws-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-aws-5.4 All versions
Ubuntu:18.04:LTS canonical linux-azure All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-4.15 All versions
Ubuntu:18.04:LTS canonical linux-azure-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-5.4 All versions
Ubuntu:18.04:LTS canonical linux-azure-edge All versions
Ubuntu:18.04:LTS canonical linux-gcp All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gcp-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gke-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gke-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gkeop-5.4 All versions
Ubuntu:18.04:LTS canonical linux-hwe All versions
Ubuntu:Pro:18.04:LTS canonical linux-hwe-5.4 All versions
Ubuntu:18.04:LTS canonical linux-hwe-edge All versions
Ubuntu:Pro:18.04:LTS canonical linux-ibm-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-kvm All versions
Ubuntu:18.04:LTS canonical linux-oem All versions
Ubuntu:Pro:18.04:LTS canonical linux-oracle All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.0 All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-oracle-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-raspi-5.4 All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-gcp-fips All versions
Ubuntu:Pro:FIPS:18.04:LTS canonical linux-aws-fips All versions
Ubuntu:20.04:LTS canonical linux-aws-5.11 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-aws-5.15 All versions
Showing 50 of 191. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:20.04:LTS canonical linux-aws-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure All versions
Ubuntu:20.04:LTS canonical linux-azure-5.11 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-5.15 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:Pro:20.04:LTS canonical linux-bluefield All versions
Ubuntu:Pro:20.04:LTS canonical linux-gcp All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.11 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-gcp-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.8 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gke-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-gkeop-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.11 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-hwe-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm-5.15 All versions
Ubuntu:20.04:LTS canonical linux-intel-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-intel-iotg-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-iot All versions
Ubuntu:Pro:20.04:LTS canonical linux-kvm All versions
Ubuntu:Pro:20.04:LTS canonical linux-lowlatency-hwe-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-nvidia-tegra-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.10 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.14 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.6 All versions
Ubuntu:Pro:20.04:LTS canonical linux-oracle All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.11 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-oracle-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-raspi All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.11 All versions
Ubuntu:Pro:20.04:LTS canonical linux-riscv-5.15 All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-xilinx-zynqmp All versions
Ubuntu:Pro:FIPS-updates:20.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:20.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:20.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS-updates:20.04:LTS canonical linux-gcp-fips All versions
Ubuntu:Pro:FIPS:20.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS:20.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS:20.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS:20.04:LTS canonical linux-gcp-fips All versions
Ubuntu:22.04:LTS canonical linux All versions
Ubuntu:22.04:LTS canonical linux-allwinner-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws All versions
Ubuntu:22.04:LTS canonical linux-aws-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.2 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.5 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.8 < 6.8.0-1011.12~22.04.1
Fix: upgrade to 6.8.0-1011.12~22.04.1
Ubuntu:22.04:LTS canonical linux-azure All versions
Ubuntu:22.04:LTS canonical linux-azure-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.5 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.8 < 6.8.0-1010.10~22.04.1
Fix: upgrade to 6.8.0-1010.10~22.04.1
Ubuntu:22.04:LTS canonical linux-azure-fde All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp All versions
Ubuntu:22.04:LTS canonical linux-gcp-5.19 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.5 All versions
Ubuntu:22.04:LTS canonical linux-gke All versions
Ubuntu:22.04:LTS canonical linux-gkeop All versions
Ubuntu:22.04:LTS canonical linux-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-ibm All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-intel-iotg All versions
Ubuntu:22.04:LTS canonical linux-kvm All versions
Ubuntu:22.04:LTS canonical linux-lowlatency All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.2 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.8 < 6.8.0-1009.9~22.04.1
Fix: upgrade to 6.8.0-1009.9~22.04.1
Ubuntu:22.04:LTS canonical linux-nvidia-tegra All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra-igx All versions
Ubuntu:22.04:LTS canonical linux-oem-5.17 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.0 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.1 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.8 < 6.8.0-1008.8~22.04.1
Fix: upgrade to 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS canonical linux-raspi All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv All versions
Ubuntu:22.04:LTS canonical linux-riscv-5.19 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.5 All versions
Ubuntu:22.04:LTS canonical linux-starfive-5.19 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.2 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.5 All versions
Ubuntu:22.04:LTS canonical linux-xilinx-zynqmp All versions
Ubuntu:Nvidia-BlueField:22.04:LTS canonical linux-bluefield All versions
Ubuntu:Pro:FIPS-preview:22.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-preview:22.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-preview:22.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS-preview:22.04:LTS canonical linux-gcp-fips All versions
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-gcp-fips All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime All versions
Ubuntu:24.04:LTS canonical linux < 6.8.0-38.38
Fix: upgrade to 6.8.0-38.38
Ubuntu:24.04:LTS canonical linux-aws < 6.8.0-1011.12
Fix: upgrade to 6.8.0-1011.12
Ubuntu:24.04:LTS canonical linux-azure < 6.8.0-1010.10
Fix: upgrade to 6.8.0-1010.10
Ubuntu:24.04:LTS canonical linux-gcp < 6.8.0-1010.11
Fix: upgrade to 6.8.0-1010.11
Ubuntu:24.04:LTS canonical linux-gke < 6.8.0-1006.9
Fix: upgrade to 6.8.0-1006.9
Ubuntu:24.04:LTS canonical linux-ibm < 6.8.0-1008.8
Fix: upgrade to 6.8.0-1008.8
Ubuntu:24.04:LTS canonical linux-intel < 6.8.0-1007.14
Fix: upgrade to 6.8.0-1007.14
Ubuntu:24.04:LTS canonical linux-lowlatency < 6.8.0-38.38.1
Fix: upgrade to 6.8.0-38.38.1
Ubuntu:24.04:LTS canonical linux-nvidia < 6.8.0-1009.9
Fix: upgrade to 6.8.0-1009.9
Ubuntu:24.04:LTS canonical linux-oem-6.8 < 6.8.0-1008.8
Fix: upgrade to 6.8.0-1008.8
Ubuntu:24.04:LTS canonical linux-oracle < 6.8.0-1008.8
Fix: upgrade to 6.8.0-1008.8
Ubuntu:24.04:LTS canonical linux-raspi < 6.8.0-1007.7
Fix: upgrade to 6.8.0-1007.7
Ubuntu:24.04:LTS canonical linux-riscv < 6.8.0-38.38.1
Fix: upgrade to 6.8.0-38.38.1
Ubuntu:Nvidia-BlueField:24.04:LTS canonical linux-bluefield All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-raspi-realtime < 6.8.0-2006.6
Fix: upgrade to 6.8.0-2006.6
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime < 6.8.1-1004.4
Fix: upgrade to 6.8.1-1004.4
Root:Debian:11 debian rootio-linux < 5.10.247-1.root.io.42
Fix: upgrade to 5.10.247-1.root.io.42
Debian:12 debian linux < 6.1.123-1
Fix: upgrade to 6.1.123-1
Debian:13 debian linux < 6.8.9-1
Fix: upgrade to 6.8.9-1
– linux linux_kernel < 6.1.121
>= 6.2, < 6.6.29
>= 6.7, < 6.8.5
6.9
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Root:Ubuntu:22.04 – linux < 5.15.0-198.208.aikido.116
Fix: upgrade to 5.15.0-198.208.aikido.116
Root:Ubuntu:22.04 – rootio-linux < 5.15.0-198.208.aikido.116
Fix: upgrade to 5.15.0-198.208.aikido.116
Ubuntu:Pro:20.04:LTS canonical linux-azure-fde-5.15 All versions
Original advisory text
CVE-2024-35870 in linux - Patched by Root
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING. To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXITING and prevent any other threads from setting a new status while we're still tearing it down. The following can be reproduced by adding some delay to right after the ipc is freed in __cifs_put_smb_ses() - which will give smb2_reconnect_server() worker a chance to run and then accessing @ses->ipc: kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x36/0x90 ? exc_general_protection+0x1c1/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? __list_del_entry_valid_or_report+0x33/0xf0 __cifs_put_smb_ses+0x1ae/0x500 [cifs] smb2_reconnect_server+0x4ed/0x710 [cifs] process_one_work+0x205/0x6b0 worker_thread+0x191/0x360 ? __pfx_worker_thread+0x10/0x10 kthread+0xe2/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published19 May 2024
Updated13 Oct 2026
First seen6 Mar 2026
Sources
ROOT-OS-DEBIAN-11-CVE-2024-35870 · OSV
CVE-2024-35870 · OSV
CVE-2024-35870 · MITRE
CVE-2024-35870 · NVD
UBUNTU-CVE-2024-35870 · OSV
DEBIAN-CVE-2024-35870 · OSV
ROOT-OS-UBUNTU-2204-CVE-2024-35870 · OSV
Track software like this
Free during beta