CVE-2026-43215: cifs: Fix locking usage for tcon fields

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-06 · updated 2026-10-30
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_ses_lock to protect a lot of objects that are not just the server, ses or tcon lists. We later introduced srv_lock, ses_lock and tc_lock to protect fields within the corresponding structs. This was done to provide a more granular protection and avoid unnecessary serialization. There were still a couple of uses of cifs_tcp_ses_lock to provide tcon fields. In this patch, I've replaced them with tc_lock.

Affected products

Linux kernel: from 6.0 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6 — fixed in 6.6.128, 6.12.75, 6.18.16, 6.19.6
Linux: 6.0 — fixed in 7.0

How to fix

Upgrade to a fixed version: Linux kernel 6.6.128, 6.12.75, 6.18.16, 6.19.6; Linux 7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-43215 or the next vulnerability affects your stack