# CVE-2026-57089 — Windows SMB Server Network Transport `srvnet.sys` Endpoint Teardown vs In-Flight Receive Race → Use-After-Free (RCE)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `srvnet.sys` (SMB Server Network Transport Driver) |
| **CVE ID** | CVE-2026-57089 |
| **Impact** | Remote Code Execution (unauthenticated, network) |
| **MSRC severity** | Important |
| **CVSS** | 7.5 / 6.5 — `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free (race-triggered) |
| **Delivery** | Network — SMB traffic to the server (no authentication) |
| **KB / Fixed build** | KB5101650 — `srvnet.sys` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `srvnet.sys` 10.0.26100.8521 — SHA256 `1f0c2fd6e4f7d624979e47d8a60d748da69cf1d2ba02d22bdd2386a7cf8657ad` |
| **Post-patch binary** | `srvnet.sys` 10.0.26100.8875 — SHA256 `d39e9a5f3e0e36943fe2612c76c8514fcd3339943e17768d87f1036e3dd573ed` |
| **Feature flag** | `Feature_3107684665` (also `Feature_1180933432`) — **CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`srvnet.sys` is the SMB server's kernel **network transport** driver. It manages SMB
**endpoint / connection** objects: they are torn down by `SrvNetTdiCloseConnection` /
`SrvNetCloseConnectionWithLock` / `SrvNetDeregisterClient`, while inbound network data
is delivered to them by the TDI receive handlers `SrvNetTdiReceiveHandler` /
`SrvNetCommonReceiveHandler` / `SrvNetTdiReceiveCompletion`.

---

## Vulnerability Summary

Pre-patch, an SMB endpoint object could be **closed and freed while a receive handler
was still processing an in-flight receive** on it — a race between connection teardown
and network receive that yields a use-after-free of the endpoint (CWE-416). Because
`srvnet` processes attacker-supplied SMB traffic **over the network without
authentication**, the freed-object reuse is a remote code-execution primitive (`AV:N`;
`AC:H` reflects the need to win the teardown/receive race).

---

## Prerequisites and Constraints

- Network, unauthenticated (`AV:N`, `PR:N`): send SMB traffic to the server's
  transport.
- Race a connection teardown against an in-flight receive on the same endpoint.
- Result: the endpoint is freed while a receive handler is still using it.

---

## Vulnerability Details

### Root Cause

The SMB endpoint's lifetime was not synchronized between teardown and in-flight
receive processing, so a close could free the endpoint while a receive handler still
referenced it.

### The patch (confirmed — diff, .8521 → .8875)

Gated behind `Feature_3107684665`, the endpoint gains **rundown protection** (a
rundown ref at `endpoint + 0x288`): allocation initializes it, receives acquire it,
and close waits for its release before teardown:

```c
// SrvNetAllocateEndpointCommon (10.0.26100.8875) — PATCHED (from the diff)
if (Feature_3107684665__private_IsEnabled())
    ExInitializeRundownProtection(endpoint + 0x158/0x288);   // init on the new endpoint

// SrvNetTdiReceiveHandler / SrvNetCommonReceiveHandler — PATCHED
if (!Feature_3107684665__private_IsEnabled()
        || ExAcquireRundownProtection(endpoint + 0x288)) {   // *** keep endpoint alive during receive ***
    ... process the receive ...
    ExReleaseRundownProtection(endpoint + 0x288);
}

// SrvNetTdiCloseConnection — PATCHED
if (Feature_3107684665__private_IsEnabled()) {
    ExWaitForRundownProtectionRelease(endpoint + 0x288);     // *** wait for in-flight receives ***
    ExRundownCompleted(endpoint + 0x288);
}
// ... only then tear down / free the endpoint
```

With receives holding rundown protection and close waiting for all references to
release before freeing, the endpoint can no longer be freed while a receive is in
flight, closing the race and the use-after-free.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3107684665`.** The rundown-protected lifecycle runs only
when the flag is enabled; the original unprotected path still ships when disabled.
Verify `Feature_3107684665` is enabled to confirm the fix is live. (Given RCE over the
network, apply KB5101650 or later regardless.)

---

## Detection Guidance

**Behavioural.** SMB connection churn — rapid connect/teardown while sending data —
against the server; use-after-free / pool-corruption bugchecks in
`srvnet!SrvNetTdiReceiveHandler` / `SrvNetTdiCloseConnection` /
`SrvNetCommonReceiveHandler` on unpatched/flag-disabled builds. Restrict SMB (445/tcp)
exposure to untrusted networks.

**Config.** The fix is CFR-gated — confirm `Feature_3107684665` is enabled.

---

## References

- MSRC advisory — CVE-2026-57089 (Windows SMB Server Network Transport Driver Remote Code Execution), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/srvnet_sys-cve-2026-57089-ghidriff.md`