CVE-2026-31609

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

State: Published
Severity: 9.8 Critical
Published: Apr 24, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to the batch list.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	cca0526ef2344cab6944d7f441fc24e152da031b to before a9940dcbe5cb92482c04efc7341039ddf7dbf607Affected 37b5c06956183b65e6808b509cf637632016cdf7 to before 22b7c1c619d808aec4cad3dc42103345e370d107Affected 21538121efe6c8c5b51c742fa02cbe820bc48714 to before f9a162c2bbcd0ac85bd07c5b37cf20286048b65cAffected 21538121efe6c8c5b51c742fa02cbe820bc48714 to before 27b7c3e916218b5eb2ee350211140e961bfc49beAffected 6.18.11 to before 6.18.24Affected 6.19.1 to before 6.19.14Affected
LinuxLinux	7.0Affected before 7.0Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

cca0526ef2344cab6944d7f441fc24e152da031b to before a9940dcbe5cb92482c04efc7341039ddf7dbf607Affected
37b5c06956183b65e6808b509cf637632016cdf7 to before 22b7c1c619d808aec4cad3dc42103345e370d107Affected
21538121efe6c8c5b51c742fa02cbe820bc48714 to before f9a162c2bbcd0ac85bd07c5b37cf20286048b65cAffected
21538121efe6c8c5b51c742fa02cbe820bc48714 to before 27b7c3e916218b5eb2ee350211140e961bfc49beAffected
6.18.11 to before 6.18.24Affected
6.19.1 to before 6.19.14Affected

LinuxLinux

7.0Affected
before 7.0Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.