CVE-2026-89636

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free tgts()

When free tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache dfs tgt structures.

If ce->tgthint is not reset before it is used later, it results in a use-after-free.

Set ce->tgthint to NULL in free tgts() after the elements are freed to reflect that no elements remain.