CVE-2024-35869: linux Use After Free
Vulnerability summary
CVE-2024-35869 is a critical (CVSS 9.8) Use After Free vulnerability in linux. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 19 · Related 16Timeline
- 19-05-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.65% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu93 products
- linux< 6.8.0-38.38
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1011.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 8e3554150d6c80a84b3cb046615d1a0e943811dc, < 645f332c6b63499cc76197f9b6bffcc659ba64cc | ≥ 8e3554150d6c80a84b3cb046615d1a0e943811dc, < e1db9ae87b7148c021daee1fcc4bc71b2ac58a79 | ≥ 8e3554150d6c80a84b3cb046615d1a0e943811dc, < 062a7f0ff46eb57aff526897bd2bebfdb1d3046a | f30d226bcc9f0e2d97b4a6e94c43a28148fbeab6 | c082c3be0f96e759ff2e361d929832fda0b93851 | ≥ 6.2.15, < 6.3 | ≥ 6.3.2, < 6.4 | 6.4
- linux_kernel≥ 6.2.8, < 6.3 | ≥ 6.4, < 6.6.29 | ≥ 6.7, < 6.8.5 | 6.9:rc1 | 6.9:rc2
Debian1 product
- linux< 6.8.9-1
3 vendors · 96 products
