External risk intelligence

Linux Kernel UAF in SMB Client Reconnect Feature.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-35870

This vulnerability exists within the Linux kernel CIFS/SMB client implementation. While it involves network protocols, it affects the client-side component (mounting remote file shares) rather than an internet-facing server or service. Direct exposure to the public internet is uncommon, as such mounts are typically restricted to internal trusted networks or VPN-connected environments.

Use After Free

Linux Kernel

before 6.1.1216.2 to before 6.6.296.7 to before 6.8.56.9

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's handling of server message block (SMB) connections could allow unauthorized access or system instability. This issue impacts the client-side component responsible for connecting to network file shares. The primary concern at this time is to confirm if this specific component is in use within our environment.

UAF bug in Linux kernel's file sharing.
Affects client-side connection to network shares.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trigger a use-after-free vulnerability in the Linux kernel's SMB client when reconnecting to a server. This occurs if a session is being torn down while another thread attempts to access it, potentially leading to system instability or compromise.

Unauthenticated network access required.
Reconnecting to an SMB server triggers the issue.
Potential for system instability or compromise.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Linux kernel's SMB client could allow a local attacker to cause a denial of service. This occurs when the kernel attempts to reconnect to an SMB server while a session is being torn down, leading to a crash.

System stability.
Race condition in session teardown.
Kernel crash, service interruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's CIFS client component is implicated, suggesting that teams managing Linux systems and their network file-sharing configurations, such as infrastructure or platform teams, should take the lead. The immediate priority is to locate all instances of the affected Linux kernel versions, determine their exposure and business criticality, and identify the accountable system owner before planning remediation activities.

Linux infrastructure and platform teams own remediation.
Verify where affected Linux kernel versions are deployed.
Plan remediation based on identified risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel CIFS/SMB client?

The Linux kernel includes a CIFS/SMB client that allows systems to mount and access network file shares, such as those hosted on Windows servers or NAS devices. This component acts as the software layer enabling a Linux machine to read and write files stored on a remote network server using the SMB protocol.

What is the vulnerability in CVE-2024-35870?

This vulnerability is a Use-After-Free (UAF) flaw, categorized as CWE-416. It occurs when the kernel attempts to access a memory location for a network session that has already been deleted or cleared. In this specific case, a race condition during the SMB reconnection process leads the kernel to interact with an invalid or freed memory address, which can cause system instability.

How does an attacker trigger this bug?

The bug is triggered during the SMB session teardown and reconnection process. A race condition must occur where one thread is actively closing a session while another thread simultaneously attempts to reconnect to the server using the same session data. The vulnerability does not trigger during standard, stable file transfer operations; it requires the specific, interrupted timing of a disconnect and reconnect cycle.

Is my system at risk for CVE-2024-35870?

Halo Surface Signal indicates that this vulnerability is unlikely to be a primary target for external internet-based attacks. Because the flaw exists in the client-side component—meaning it affects machines mounting remote shares—it is typically confined to internal networks or VPNs. Systems that do not use CIFS/SMB to mount remote network file shares are not impacted.

What should I do to address this issue?

Your first step is to identify all Linux systems in your environment running the affected kernel versions. Once identified, consult your Linux distribution's security notices to obtain the appropriate kernel update that includes the fix. Remediation should be prioritized for systems that frequently mount and disconnect from remote SMB file shares, as these are the most likely to encounter the race condition.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.