CVE-2026-31608

The smb_direct_flush_send_list() function internally calls smb_direct_free_sendmsg() to release resources associated with a message sent by SMB Direct. The problem is that after the message is moved to the batch list by post_sendmsg(), the smb_direct_free_sendmsg() function is called a second time — resulting in a double-free of the same memory area. Such an error can lead to heap corruption (heap corruption), which is a classic vector for hijacking program execution flow control.

A remote, unauthenticated attacker can trigger kernel memory corruption, potentially enabling arbitrary code execution (RCE) with kernel privileges, privilege escalation, or causing system failure (denial of service).

Apply patches available from the vendor according to the references — appropriate commits have been published in the Linux kernel stable repository (git.kernel.org). It is recommended to update the kernel to a version containing the aforementioned fixes.

Linux Kernel — versions indicated in vendor references (commits available at the addresses provided in the references section).