CVE-2024-35869

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The issue is related to a potential use-after-free bug in the Linux kernel's SMB client when walking DFS referrals, mounting, and performing DFS failover. This is resolved by ensuring all children from the parent session are refcounted, as they are needed across the entire DFS mount. The fix also involves getting rid of the dfs ses list.

Recommendations Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable SMB client functionality until a patch is applied.