{"id":7192,"date":"2026-09-04T18:49:27","date_gmt":"2026-09-04T10:49:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74259"},"modified":"2026-09-04T18:49:27","modified_gmt":"2026-09-04T10:49:27","slug":"cve-2026-74259","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74259","title":{"rendered":"CVE-2026-74259 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: remove all cifs"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>cifs: remove all cifs files before kill super<\/p>\n<p>Cifs files may be put into fileinfo_put_wq during umounting cifs.<br \/>\nAfter umount done, cifsFileInfo_put_final is called, which cause<br \/>\nfollowing BUG:<\/p>\n<p>BUG: kernel NULL pointer dereference, address: 0000000000000000<br \/>\n&#8230;<br \/>\n[  134.222152]  list_lru_add+0x64\/0x1a0<br \/>\n[  134.222399]  ? cifs_put_tcon+0x171\/0x340 [cifs]<br \/>\n[  134.222772]  d_lru_add+0x44\/0x60<br \/>\n[  134.222997]  dput+0x1fc\/0x210<br \/>\n[  134.223213]  cifsFileInfo_put_final+0x11a\/0x140 [cifs]<br \/>\n[  134.223576]  process_one_work+0x17c\/0x320<br \/>\n[  134.223843]  worker_thread+0x188\/0x280<br \/>\n[  134.224084]  ? __pfx_worker_thread+0x10\/0x10<br \/>\n[  134.224366]  kthread+0xcc\/0x100<br \/>\n[  134.224576]  ? __pfx_kthread+0x10\/0x10<br \/>\n[  134.224827]  ret_from_fork+0x30\/0x50<br \/>\n[  134.225063]  ? __pfx_kthread+0x10\/0x10<br \/>\n[  134.225328]  ret_from_fork_asm+0x1b\/0x30<\/p>\n<p>This can be reproduce by following:<br \/>\nunshare -n bash -c &#8221;<br \/>\nmkdir -p ${CIFS_MNT}<br \/>\nip netns attach root 1<br \/>\nip link add eth0 type veth peer veth0 netns root<br \/>\nip link set eth0 up<br \/>\nip -n root link set veth0 up<br \/>\nip addr add 192.168.0.2\/24 dev eth0<br \/>\nip -n root addr add 192.168.0.1\/24 dev veth0<br \/>\nip route add default via 192.168.0.1 dev eth0<br \/>\nip netns exec root sysctl net.ipv4.ip_forward=1<br \/>\nip netns exec root iptables -t nat -A POSTROUTING -s 192.168.0.2 -o<br \/>\n${DEV} -j MASQUERADE<br \/>\nmount -t cifs ${CIFS_PATH} ${CIFS_MNT} -o<br \/>\nvers=3.0,sec=ntlmssp,credentials=${CIFS_CRED},rsize=65536,wsize=65536,cache=none,echo_interval=1<br \/>\ntouch ${CIFS_MNT}\/a.txt<br \/>\nip netns exec root iptables -t nat -D POSTROUTING -s 192.168.0.2 -o<br \/>\n${DEV} -j MASQUERADE<br \/>\n&#8221;<br \/>\numount ${CIFS_MNT}<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>cifs: remove all cifs files before kill super<\/p>\n<p>Cifs files may be put into fileinfo_put_wq during umounting cifs.<br \/>\nAfter umount done,<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7192","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}