CVE-2026-31609

The smbd_send_batch_flush() function independently calls smbd_free_send_io() to free input/output resources. After the operation is moved to the batch list by smbd_post_send(), smbd_free_send_io() is called again on the same object, resulting in double-free of the same memory. Such a memory management error can lead to heap corruption and system instability or arbitrary code execution.

An attacker can cause kernel memory corruption, which may in turn enable remote code execution (RCE), privilege escalation, or system crash (denial of service).

Patches available from the vendor should be applied according to the references: commits 22b7c1c619d8, 27b7c3e91621, a9940dcbe5cb and f9a162c2bbcd available in the stable Linux kernel repository (git.kernel.org/stable).

Linux Kernel — versions indicated in vendor references (patches available at addresses in git.kernel.org references)