CVE-2026-45972

The issue is that the variables @err_iov and @err_buftype are not zeroed before re-invoking SMB2_open(). If the @data pointer is not NULL, this leads to access of already freed memory (use-after-free). Otherwise, the same memory resources may be freed twice (double free), which can result in corruption of the kernel heap structure.

An attacker may potentially lead to arbitrary code execution in kernel context, privilege escalation, or destabilization of the operating system by triggering use-after-free or double free conditions.

Patches available from the vendor should be applied according to the references — patches have been published in the kernel.org repository (git.kernel.org/stable) for many stable branches. It is recommended to update the kernel to a version containing the indicated commits.

Linux kernel with SMB client enabled (cifs/smb3 module); versions indicated in vendor references (commits available in stable branches of the kernel.org repository)