CVE-2024-35866 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-35866?

CVE-2024-35866 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's SMB client implementation. Attackers could potentially exploit this to crash the kernel or execute arbitrary code with kernel privileges. Systems running vulnerable Linux kernel versions with SMB client functionality are affected.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's SMB client implementation. Attackers could potentially exploit this to crash the kernel or execute arbitrary code with kernel privileges. Systems running vulnerable Linux kernel versions with SMB client functionality are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable kernel versions referenced in the git commits (need to check which kernel versions contain these commits)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires SMB client functionality to be used. The vulnerability triggers during session teardown in cifs_dump_full_key() function.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash or arbitrary code execution with kernel privileges, potentially resulting in full system compromise.

🟠

Likely Case

Kernel panic causing system instability or denial of service, requiring system reboot.

🟢

If Mitigated

Limited impact due to exploit complexity and requirement for local access or specific SMB session conditions.

🌐 Internet-Facing: LOW - Requires SMB client functionality and specific session conditions, not typically directly internet-exposed.

🏢 Internal Only: MEDIUM - Internal attackers with access to trigger SMB client operations could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the vulnerable code path during SMB session teardown. Likely requires local access or ability to manipulate SMB sessions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the referenced git commits (10e17ca4000ec34737bde002a13435c38ace2682 and others)

Vendor Advisory: https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution's package manager for kernel updates. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable SMB client functionality

linux

Prevent use of SMB client which would trigger the vulnerable code path

# Consider unloading cifs module if not needed: sudo modprobe -r cifs
# Note: This may break SMB file sharing functionality

🧯 If You Can't Patch

Restrict SMB client usage to trusted networks only
Implement strict access controls to prevent unauthorized users from initiating SMB operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with affected versions. Check if cifs module is loaded: lsmod | grep cifs

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond vulnerable versions. Check that cifs module functions normally without crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System crashes during SMB operations
OOM killer activity related to cifs

Network Indicators:

Unusual SMB session termination patterns
Multiple failed SMB connections

SIEM Query:

source="kernel" AND ("panic" OR "Oops") AND "cifs"

📊 Metadata

CVE ID: CVE-2024-35866

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 19, 2024

Last Updated: December 1, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35866, you might also want to check these: