Executive brief
A vulnerability was identified in the Linux kernel's SMB client, which is used to connect to Windows-style file shares. Under specific error conditions when browsing directories, the system could attempt to free the same memory buffer twice. This type of memory management error typically leads to a system crash (kernel panic), potentially causing a denial of service for the affected machine.
Technical details
A double-free vulnerability exists in the Linux kernel SMB client within 'fs/smb/client/smb2pdu.c'. The issue occurs when a response-bearing attempt returns a replayable error and frees its response buffer. If 'SMB2_query_directory_init()' fails before the subsequent retry, the cleanup routine incorrectly retains the previous buffer type and attempts to free the already-freed response buffer again. This is caused by a failure to reset response bookkeeping before each replay attempt. Attackers could potentially trigger this via a malicious or malfunctioning SMB server to cause a kernel oops or denial of service. Patches have been released for various stable branches including 6.6.x, 6.12.x, 6.18.x, and 7.1.x.
Affected products
- Linux Linux Kernel 6.8 to 7.1.4, 6.6.32 to 6.6.145
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336
- https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994
- https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde
- https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98
- https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7