Security readout for executives and security teams
Plain-English summary
A Linux SMB client memory-safety flaw may access a session after it has been freed during DFS referral, mount, or failover operations. The supplied CVSS score is 9.8, indicating potentially severe confidentiality, integrity, and availability impact. Actual exploitability and observed real-world impact are not established by the provided sources.
Executive priority
Treat as an urgent patch-validation issue for Linux SMB clients using DFS, especially business-critical file-access systems. Do not infer universal Internet exposure from the 9.8 score. Establish the affected fleet and vendor-fixed package availability promptly, then schedule controlled updates according to operational criticality.
Technical view
CVE-2024-35869 is a potential use-after-free caused by insufficient reference counting of child sessions derived from tcon->ses across an SMB DFS mount. The kernel correction retains those child sessions throughout referral traversal, mounting, and DFS failover, and removes tcon->dfs_ses_list.
Likely exposure
Prioritize Linux systems that act as SMB clients and use DFS referrals, DFS mounts, or DFS failover. The supplied affected-version data lists 6.4, 6.6.29, 6.8.5, and 6.9, but its version boundaries are ambiguous. Confirm exposure using the exact distribution kernel build and vendor advisory.
Exploitation context
The supplied CVSS vector describes network-reachable, low-complexity, unauthenticated exploitation without user interaction. However, the sources only describe a potential use-after-free; they provide no exploit demonstration or attack prerequisites. The CVE is not identified as KEV in the bundle, so active exploitation is not established.
Researcher notes
The core defect is lifetime management during multi-session DFS operations, not a generic SMB server flaw. Source metadata labels the issue critical, but it does not document a proof of concept, reliable exploitation, or attack-controlled trigger conditions. The supplied version records contain unusual and overlapping entries, so distribution-specific applicability requires confirmation.
Mitigation direction
- Check the Linux distribution's advisory for the exact fixed kernel package and affected release boundaries.
- Update exposed systems to a vendor-supported kernel containing the referenced upstream correction.
- Prioritize SMB clients using DFS referrals, mounts, or failover workflows.
- If immediate updating is impossible, reduce unnecessary SMB DFS use pending vendor guidance.
Validation and detection
- Record each system's running kernel and distribution package version.
- Identify systems mounting SMB shares or configured for DFS referral and failover behavior.
- Compare kernel packages against distribution advisories and referenced stable-kernel corrections.
- After updating, reboot if required and verify the running kernel is the corrected build.
- Monitor kernel logs for SMB client crashes or memory-safety symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-35869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64ccCVE reference, Linux
- https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79CVE reference, Linux
- https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.