CVE-2026-31608

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

State: Published
Severity: 9.8 Critical
Published: Apr 24, 2026
Updated: Aug 5, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg() moved it to the batch list.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7 to before 6968c91fab05b8fc4d6700e0cf34472bb422df25Affected 79242e7b6bc63efec28b7c235bc320806afce6c0 to before 2ba03f46132b0d1a7bafb86e1ef61951a2254023Affected 34abd408c8ba24d7c97bd02ba874d8c714f49db1 to before 830de6eeb9db4cb7e758201fb99328ef4ca4b032Affected 34abd408c8ba24d7c97bd02ba874d8c714f49db1 to before 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72Affected 6.18.11 to before 6.18.24Affected 6.19.1 to before 6.19.14Affected
LinuxLinux	7.0Affected before 7.0Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7 to before 6968c91fab05b8fc4d6700e0cf34472bb422df25Affected
79242e7b6bc63efec28b7c235bc320806afce6c0 to before 2ba03f46132b0d1a7bafb86e1ef61951a2254023Affected
34abd408c8ba24d7c97bd02ba874d8c714f49db1 to before 830de6eeb9db4cb7e758201fb99328ef4ca4b032Affected
34abd408c8ba24d7c97bd02ba874d8c714f49db1 to before 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72Affected
6.18.11 to before 6.18.24Affected
6.19.1 to before 6.19.14Affected

LinuxLinux

7.0Affected
before 7.0Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.