CVE-2026-45972

smb: client: fix potential UAF and double free in smb2_open_file()

State: Published
Severity: 9.8 Critical
Published: May 27, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF and double free in smb2_open_file()

Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NULL, otherwise a double free.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-825 Expired Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	743f70406264348c0830f38409eb6c40a42fb2db to before 96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74Affected 3a6d6b332f92990958602c1e35ce0173e2dd62e9 to before 7425453ea16dbc3bbb0f6cac4d60b537e5e4d151Affected b64e3b5d8d759dd4333992e4ba4dadf9359952c8 to before 4d339b219004869e96c4ce56b8891f83a38da4c0Affected 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 to before e66dcf7bb9c4df5582c82bc3582725abcbfbea73Affected e3a43633023e3cacaca60d4b8972d084a2b06236 to before 639deb962986ef2f5e2a6d5a600c66f922471e81Affected e3a43633023e3cacaca60d4b8972d084a2b06236 to before ebbbc4bfad4cb355d17c671223d0814ee3ef4edaAffected 6.1.163 to before 6.1.165Affected 6.6.124 to before 6.6.128Affected 6.12.70 to before 6.12.75Affected 6.18.10 to before 6.18.14Affected
LinuxLinux	6.19Affected before 6.19Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

743f70406264348c0830f38409eb6c40a42fb2db to before 96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74Affected
3a6d6b332f92990958602c1e35ce0173e2dd62e9 to before 7425453ea16dbc3bbb0f6cac4d60b537e5e4d151Affected
b64e3b5d8d759dd4333992e4ba4dadf9359952c8 to before 4d339b219004869e96c4ce56b8891f83a38da4c0Affected
9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 to before e66dcf7bb9c4df5582c82bc3582725abcbfbea73Affected
e3a43633023e3cacaca60d4b8972d084a2b06236 to before 639deb962986ef2f5e2a6d5a600c66f922471e81Affected
e3a43633023e3cacaca60d4b8972d084a2b06236 to before ebbbc4bfad4cb355d17c671223d0814ee3ef4edaAffected
6.1.163 to before 6.1.165Affected
6.6.124 to before 6.6.128Affected
6.12.70 to before 6.12.75Affected
6.18.10 to before 6.18.14Affected

LinuxLinux

6.19Affected
before 6.19Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.