Use‑After‑Free in Linux CIFS Driver (CVE‑2026‑72315) Enables Local Privilege Escalation
What It Is — The Zero Day Initiative advisory ZDI‑26‑836 (CVE‑2026‑72315) describes a use‑after‑free flaw in the cifs_newfile_info function of the Linux kernel’s CIFS file‑system driver. An attacker who can already execute code with high privileges on a system can trigger the flaw to gain kernel‑level execution, effectively escalating to full system compromise. The vulnerability scores a CVSS 7.2 (AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) and is classified as a local privilege‑escalation bug. Linux maintainers have released a patch (see the commit 75f5c412) that corrects the missing object‑existence validation.
Affected Products — Linux kernel (all distributions that include the vulnerable CIFS driver prior to the October 2026 patch).
Why It Matters for Trust & Control Assurance — The issue highlights the need for robust privilege‑management and patch‑management controls that ensure privileged code cannot bypass validation checks, a control objective that maps to many frameworks (e.g., NIST CSF Identify and Protect functions).
Recommended Actions —
- Deploy the kernel update that fixes CVE‑2026‑72315 on all Linux hosts.
- Verify the running kernel version on each system and retain evidence of the patch status for audit purposes.
- Review privileged‑process hardening policies to ensure least‑privilege and separation‑of‑duty safeguards are enforced.
Source: Zero Day Initiative Advisory