CVE-2026-98175

In the Linux kernel, the following vulnerability has been resolved:

smb: client: cancel reconnect work in clean_demultiplex_info()

clean_demultiplex_info() cancels server->echo delayed work but not

server->reconnect, which can cause a use-after-free when the

demultiplex thread exits while a reconnect work is still queued:

cifs_demultiplex_thread()

cifs_readv_from_socket()

cifs_reconnect()

__cifs_reconnect()

cifs_queue_server_reconn()

mod_delayed_work(cifsiod_wq, &server->reconnect, 0)

clean_demultiplex_info()

cancel_delayed_work_sync(&server->echo) // echo canceled

// reconnect NOT canceled

kfree_sensitive(server) // server freed

...later, on cifsiod_wq:

smb2_reconnect_server()

server->srv_count // UAF read of freed server

Fix this by canceling server->reconnect delayed work in

clean_demultiplex_info() before the server is freed, the same way

cifs_put_tcp_session() already does.