CVE-2026-31608

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

Published Apr 24, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(),
so we should not call it again after post_sendmsg()
moved it to the batch list.

Analysis

Technical impact

A double‑free bug in the Linux kernel SMB server is triggered by calling smb_direct_free_sendmsg() twice, once by smb_direct_flush_send_list() and again after a message is sent. This flaw, identified as CWE‑1341 and CWE‑415, can corrupt kernel memory structures, although the advisory text does not mention any observed crashes or exploitation. The vulnerability has been resolved by moving the duplicate call to the batch list so that both paths are no longer executed.

Affected Systems

The issue affects Linux kernel releases that do not yet contain the referenced commits, as indicated by the Git commit links in the advisory. Administrators should verify that the running kernel includes the fix applied in the commits listed, otherwise the system remains vulnerable.

Risk and Exploitability

The CVSS score of 9.8 underscores the criticality, while the EPSS value of <1% suggests a low likelihood of current exploitation. The double‑free occurs within the SMB protocol stack, so a likely attack vector would be an attacker sending malicious SMB packets to trigger the flaw. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7`	affected	< 6968c91fab05b8fc4d6700e0cf34472bb422df25
`79242e7b6bc63efec28b7c235bc320806afce6c0`	affected	< 2ba03f46132b0d1a7bafb86e1ef61951a2254023
`34abd408c8ba24d7c97bd02ba874d8c714f49db1`	affected	< 830de6eeb9db4cb7e758201fb99328ef4ca4b032
`34abd408c8ba24d7c97bd02ba874d8c714f49db1`	affected	< 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72
`6.18.11`	affected	< 6.18.24
`6.19.1`	affected	< 6.19.14

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.18.24`	unaffected	≤ 6.18.*
`6.19.14`	unaffected	≤ 6.19.*
`7.0.1`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7,6968c91fab05b8fc4d6700e0cf34472bb422df25)`	affected	code_commit	—
`[79242e7b6bc63efec28b7c235bc320806afce6c0,2ba03f46132b0d1a7bafb86e1ef61951a2254023)`	affected	code_commit	—
`[34abd408c8ba24d7c97bd02ba874d8c714f49db1,830de6eeb9db4cb7e758201fb99328ef4ca4b032)`	affected	code_commit	—
`[34abd408c8ba24d7c97bd02ba874d8c714f49db1,84ff995ae826aa6bbcc6c7b9ea569ff67c021d72)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[6.18.24,6.19.0)`	unaffected	semver	—
`[6.19.14,6.20.0)`	unaffected	semver	—
`[7.0.1,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest stable Linux kernel that includes the patch from the referenced Git commits to eliminate the double‑free error.
Reboot the host to load the updated kernel so that the SMB service runs the fixed code path.
If SMB is unnecessary, disable the service or restrict access to trusted hosts with firewall rules.

Generated by OpenCVE AI on April 30, 2026 at 14:07 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8488-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8488-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8507-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.457% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2ba03f46132b0d1a7bafb86e1ef61951a2254023
https://git.kernel.org/stable/c/6968c91fab05b8fc4d6700e0cf34472bb422df25
https://git.kernel.org/stable/c/830de6eeb9db4cb7e758201fb99328ef4ca4b032
https://git.kernel.org/stable/c/84ff995ae826aa6bbcc6c7b9ea569ff67c021d72
https://lore.kernel.org/linux-cve-announce/2026042421-CVE-2026-31608-1786@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31608
https://www.cve.org/CVERecord?id=CVE-2026-31608

History

Apr 29, 2026 8:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-415

Apr 27, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Apr 27, 2026 11:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/84ff995ae826aa6bbcc6c7b9ea569ff67c021d72

Apr 25, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026042421-CVE-2026-31608-1786@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31608 https://www.cve.org/CVERecord?id=CVE-2026-31608

Apr 24, 2026 3:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg() moved it to the batch list.
Title		smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2ba03f46132b0d1a7bafb86e1ef61951a2254023 https://git.kernel.org/stable/c/6968c91fab05b8fc4d6700e0cf34472bb422df25 https://git.kernel.org/stable/c/830de6eeb9db4cb7e758201fb99328ef4ca4b032