CVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifstryadding_channels()

cifstryadding_channels() takes a temporary reference to an interface

before dropping ifacelock. If cifssesaddchannel() fails, it drops

that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while

channel creation is in progress. In that case, the failure-path

kref_put() releases the last reference and frees iface. Updating

weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference,

keeping iface alive for the final access.