In the Linux kernel, the following vulnerability has been resolved:

smb: client: cancel reconnect work in clean demultiplex info()

clean demultiplex info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued:

cifs demultiplex thread() cifs readv from socket() cifs reconnect() cifs reconnect() cifs queue server reconn() mod delayed work(cifsiod wq, &server->reconnect, 0) clean demultiplex info() cancel delayed work sync(&server->echo) // echo canceled // reconnect NOT canceled kfree sensitive(server) // server freed

...later, on cifsiod wq:

smb2 reconnect server() server->srv count // UAF read of freed server

Fix this by canceling server->reconnect delayed work in clean demultiplex info() before the server is freed, the same way cifs put tcp session() already does.