In the Linux kernel, the following vulnerability has been resolved:

smb: client: clear ce->tgthint in free_tgts()

When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.

If ce->tgthint is not reset before it is used later, it results
in a use-after-free.

Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
54be1f6c1c37498bba557049df646cc239fa37e3 affected < 7507bd1885643d0461a6017767492450af1ce2a3
54be1f6c1c37498bba557049df646cc239fa37e3 affected < 9ab46a13798a61d9d020b01d4e57efdabe6624fa
54be1f6c1c37498bba557049df646cc239fa37e3 affected < 5baab40404a9393bcc0b7b8f1950bf2c307e0984
54be1f6c1c37498bba557049df646cc239fa37e3 affected < b1b741cf8e7ce1b91d937e23decd3d3358748700
Linux Linux affected
Version Status Constraints
5.0 affected —
0 unaffected < 5.0
6.12.109 unaffected ≤ 6.12.*
6.18.50 unaffected ≤ 6.18.*
7.2.4 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-89636 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-89636 cve-icon
History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
Title smb: client: clear ce->tgthint in free_tgts()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:45:30.283Z

Reserved: 2026-09-11T19:38:34.739Z

Link: CVE-2026-89636

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:49.243

Modified: 2026-09-11T20:19:49.243

Link: CVE-2026-89636

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-11T19:45:30Z

Links: CVE-2026-89636 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T06:30:09Z

Weaknesses