CVE-2024-35863: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35863 is a use-after-free (UAF) vulnerability discovered in the Linux kernel's SMB client implementation, specifically in the is_valid_oplock_break() function. The vulnerability was disclosed on May 19, 2024, affecting various versions of the Linux kernel up to versions 6.1.85, 6.6.26, and 6.8.5. This security issue occurs when handling SMB sessions that are being torn down (NVD).

The vulnerability is classified as a Use-After-Free (CWE-416) with a CVSS v3.1 base score of 7.8 (High). The issue specifically occurs in the SMB client's is_valid_oplock_break() function when processing sessions that are being terminated (status == SES_EXITING). The technical fix involves skipping sessions that are being torn down to prevent the use-after-free condition (NVD, Kernel Patch).

The vulnerability affects Linux systems using the SMB client functionality and could potentially lead to privilege escalation, information disclosure, or system crashes due to the use-after-free condition. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of affected systems (NVD).

The vulnerability requires local access to the system and low privileges to exploit. The CVSS metrics indicate low attack complexity (AC:L) and low privileges required (PR:L), suggesting that exploitation is relatively straightforward for an attacker with local access (NVD).

The vulnerability has been patched in various Linux kernel versions. Fixed versions include Linux kernel 6.8.0-38.38 for Ubuntu 24.04 LTS, 6.8.0-1011.12 for AWS kernels, and 6.8.0-1010.10 for Azure kernels. Users are advised to update their systems to the patched versions (Ubuntu).