External risk intelligence

Linux Kernel SMB Client Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-35865

This vulnerability exists in the Linux kernel SMB client implementation. While network-reachable in environments utilizing SMB mounts, this functionality is typically restricted to internal network segments or controlled environments rather than exposed directly to the public internet.

Use After Free

Linux Kernel

before 6.1.856.2 to before 6.6.266.7 to before 6.8.56.9

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's SMB client could allow unauthorized access and modification of data. This issue, now resolved, relates to how the kernel handles certain network operations. While the impact is considered unlikely to affect most organizations, it's important to confirm if your environment utilizes this specific kernel functionality.

Kernel flaw allowed unauthorized data access.
Unlikely to affect most organizations.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic targeting the Linux kernel's SMB client. This could potentially lead to unauthorized access to sensitive data or system compromise.

Requires network access.
Triggered by SMB client communication.
Risk of data corruption or disclosure.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Linux kernel's SMB client could allow an attacker to impact system stability or potentially execute code. This could occur when a session is being torn down while an operation is still in progress, leading to the crash or compromise of services relying on the SMB client.

System stability and service availability.
Via network access to SMB client.
Potential for denial-of-service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SMB client requires immediate attention from infrastructure and platform teams responsible for managing Linux systems. The first critical step is to identify all systems running affected kernel versions, assess their exposure to SMB network traffic, and determine their business criticality. Once ownership is confirmed, a targeted remediation plan can be developed based on the identified risk.

Infrastructure and platform teams own resolution.
Verify SMB usage and system criticality first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel and its SMB client?

The Linux kernel is the core foundation of the Linux operating system, managing hardware and system resources. The SMB client component specifically allows Linux systems to connect to and interact with remote file shares, often used in corporate environments to access shared drives or printers on a network.

What does CVE-2024-35865 mean by Use-After-Free?

A Use-After-Free, or CWE-416, is a memory management weakness. It occurs when a program continues to use a pointer to a memory location even after that memory has been freed or released. In this CVE, the flaw specifically involves the SMB client trying to process network operations on a session that is already in the process of being shut down.

When does this vulnerability trigger?

This bug is triggered when the kernel attempts to process an oplock break—a mechanism used to coordinate file access—on an SMB session that is actively being disconnected. If the session state is marked as exiting, the kernel may attempt to access memory that is no longer valid. Simply having an active SMB connection does not trigger the flaw; it requires the specific timing of a connection teardown.

Do I need to worry if my Linux systems are internal?

According to Halo Surface Signal, this vulnerability is considered unlikely for many because it relies on the SMB client being network-reachable. While the CVSS score reflects a network-based attack vector, SMB traffic is typically restricted to internal, segmented networks rather than exposed directly to the public internet, which reduces the practical risk for most internal infrastructure.

How should I respond to this Linux kernel vulnerability?

First, identify if you are running any of the affected kernel versions listed in the vendor product data. If you are, determine if those systems actually utilize the SMB client for network file sharing. Prioritize patching systems that are critical to your operations or those that frequently manage SMB connections, coordinating with your platform teams to apply the necessary kernel updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.