Executive brief
A vulnerability exists in the Linux kernel's SMB client, which is used to connect to network file shares. Under specific error conditions during a file operation, the system may attempt to free the same memory buffer twice. This can lead to a system crash or instability, potentially disrupting access to network storage and impacting business operations.
Technical details
A double-free vulnerability exists in the Linux kernel's SMB client (cifs.ko) within the SMB2_ioctl() function. When a request attempt returns a replayable error, the response buffer is freed. If a subsequent call to SMB2_ioctl_init() fails before the next transmission, the cleanup routine incorrectly retains the previous buffer type and attempts to free the already-freed response buffer again. This occurs because response bookkeeping is not reset between replay attempts. The fix involves resetting the response buffer type and zeroing the response I/O vector at the start of each replay attempt. Patches are available in various stable kernel branches including 6.6.145, 6.12.96, 6.18.39, and 7.1.4.
Affected products
- Linux Linux 6.6.32 to 6.6.145, 6.8 to 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6
- https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b
- https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6
- https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9
- https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72