Description
In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

smbd_send_batch_flush() already calls smbd_free_send_io(),
so we should not call it again after smbd_post_send()
moved it to the batch list.
Published: 2026-04-24
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel’s SMB client has a double‑free vulnerability in the smbd_send_batch_flush() routine, which calls smbd_free_send_io() a second time after it has already been freed. This is a classic double‑free flaw (CWE‑415) that can cause heap corruption in the kernel, potentially leading to arbitrary code execution with kernel privileges.

Affected Systems

All Linux kernel releases that contain the SMB client code before the fix are impacted. Specific version ranges are not provided, so any kernel built from source or distributed before the commit that removes the double‑free will be vulnerable. The issue applies to the generic Linux kernel across all distributions.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical vulnerability, while an EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could trigger this double‑free (CWE‑415) by sending specially crafted SMB traffic to a vulnerable client, potentially causing memory corruption and kernel privilege escalation.

Generated by OpenCVE AI on April 29, 2026 at 21:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Linux kernel that incorporates the SMB client double‑free fix using your distribution’s package manager or source build.
  • Reboot the host so the updated kernel image is active.
  • If a patched kernel is not available and SMB traffic must remain enabled, temporarily disable or restrict SMB services until a newer kernel can be installed.

Generated by OpenCVE AI on April 29, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-415

Mon, 27 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 27 Apr 2026 11:30:00 +0000

Type Values Removed Values Added
References

Sat, 25 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 24 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to the batch list.
Title smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-11T22:12:07.177Z

Reserved: 2026-03-09T15:48:24.122Z

Link: CVE-2026-31609

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-04-24T15:16:40.160

Modified: 2026-04-29T16:45:12.507

Link: CVE-2026-31609

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31609 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T21:45:20Z

Weaknesses