KernelScan.io

CRITICAL

smb OpenFile UAF

CVE-2026-45972

CVSS 9.8 / 10.0 NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

KernelScan AI7.6HIGH

01

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NULL, otherwise a double free.

02

Engine v0.2.0

Risk summary

Local users with low privileges can trigger use-after-free or double-free conditions in the SMB client when opening files with specific access patterns. This can lead to kernel memory corruption, privilege escalation, or system crashes on systems mounting SMB/CIFS shares.

Affectedfs/smb/client/smb2file.c (SMB client)

Vulnerability analysis

The vulnerability occurs in smb2_open_file() when retrying SMB2_open() after an access denied error. The original code frees the response buffer via free_rsp_buf() but fails to zero out err_iov and reset err_buftype before the retry. On the retry path, if SMB2_open() does not repopulate these variables (e.g., when data != NULL), the stale pointer is reused, leading to a use-after-free or double-free of the kernel response buffer. The fix adds memset(&err_iov, 0, sizeof(err_iov)) and err_buftype = CIFS_NO_BUFFER before the retry to ensure clean state. This is reachable locally when performing file operations on a mounted SMB share that triggers the access-permission fallback.

03

BranchFixed inPatch commit
6.16.1.16596e53bb3ee2f
6.126.12.754d339b219004
6.186.18.14e66dcf7bb9c4
6.196.19.4639deb962986
6.66.6.1287425453ea16d
mainline7.0ebbbc4bfad4c