In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free in cifs_try_adding_channels()

cifs_try_adding_channels() takes a temporary reference to an interface
before dropping iface_lock. If cifs_ses_add_channel() fails, it drops
that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while
channel creation is in progress. In that case, the failure-path
kref_put() releases the last reference and frees iface. Updating
weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference,
keeping iface alive for the final access.

https://git.kernel.org/stable/c/1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805

https://git.kernel.org/stable/c/1ffacbadc14530e55b8d86f7b917524f6a0fb891

https://git.kernel.org/stable/c/47dfac48bce7198ad4f1a388fc8c9491f878ac3b

https://git.kernel.org/stable/c/4986410316b1ae0e63c6ce418e4eb196723626e7

https://git.kernel.org/stable/c/64d7584e62ac8cdc750455c5fdc6008fc2de4f06

https://git.kernel.org/stable/c/c292d4686f717c03e5022fc4ae7c782f39a94915

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/sess.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cbc53148cc0946b72d62a3c53870cb22ce4ec284","lessThan":"64d7584e62ac8cdc750455c5fdc6008fc2de4f06","versionType":"git","status":"affected"},{"version":"cff97d683a083b862a8bb24309e0f4d2d928128a","lessThan":"c292d4686f717c03e5022fc4ae7c782f39a94915","versionType":"git","status":"affected"},{"version":"6aac002bcfd554aff6d3ebb55e1660d078d70ab0","lessThan":"47dfac48bce7198ad4f1a388fc8c9491f878ac3b","versionType":"git","status":"affected"},{"version":"6aac002bcfd554aff6d3ebb55e1660d078d70ab0","lessThan":"1ffacbadc14530e55b8d86f7b917524f6a0fb891","versionType":"git","status":"affected"},{"version":"6aac002bcfd554aff6d3ebb55e1660d078d70ab0","lessThan":"1305eadc6a7d78a8d0a52eee29ddd2d9e8a27805","versionType":"git","status":"affected"},{"version":"6aac002bcfd554aff6d3ebb55e1660d078d70ab0","lessThan":"4986410316b1ae0e63c6ce418e4eb196723626e7","versionType":"git","status":"affected"},{"version":"22a6c5b3425f327e7f4c3606a72277dce82c7d83","versionType":"git","status":"affected"},{"version":"6.1.78","lessThan":"6.1.183","versionType":"semver","status":"affected"},{"version":"6.6.17","lessThan":"6.6.152","versionType":"semver","status":"affected"},{"version":"6.7.5","lessThan":"6.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/sess.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]