CVE-2026-45972: Linux kernel SMB client use-after-free and double free in smb2_open_file()
CVE-2026-45972 is a memory-safety flaw in the Linux kernel SMB client. Error buffers are not cleared before SMB2_open() is retried, which can lead to a use-after-free or a double free. The record classifies it as CWE-416 with a CVSS 3.1 base score of 9.8 from the CNA, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-45972 affects the SMB client code of the Linux kernel, in the smb2_open_file() path. According to the record, the error-handling state (the @err_iov and @err_buftype variables) is not reset before SMB2_open() is retried. When @data is not NULL this can cause a use-after-free, and otherwise a double free. The vulnerability is recorded as CWE-416 (Use After Free).
Impact
- The record gives a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, as published by the CNA. Another provider in the record lists a score of 7.
- SSVC data in the record marks the issue as automatable and with total technical impact.
- Memory corruption in kernel code can, in general, lead to crashes or other integrity and confidentiality effects. The record does not describe a specific observed outcome, so the exact consequences in a given deployment are unknown.
Affected products and versions
The record lists two product entries (Linux Linux and Linux Linux Kernel) with these ranges:
- from 6.1.163 up to before 6.1.165
- 6.19 (listed as a single version)
- from 6.19.1 up to before 6.19.4
- from 6.18.10 up to before 6.18.14
- from 6.12.70 up to before 6.12.75
- from 6.6.124 up to before 6.6.128
The record also contains ranges expressed as commit identifiers, which are not translated into version numbers here. Consult the stable kernel changelogs and your distribution advisories to determine whether a given build contains the fix.
Exploitation status
The CISA KEV catalog entry in the record is not listed, and the SSVC exploitation field is none. No confirmed active exploitation appears in the sources consulted. This assessment may change as new information is published.
Remediation and mitigation
- Update to a kernel release that includes the upstream fix. The record lists patch references for the affected stable branches.
- Prefer vendor or distribution kernel packages that explicitly list this CVE as fixed, since backports vary.
- Where patching is delayed, reduce exposure by limiting use of the SMB client module on systems that do not need it, following your organisation's hardening policy.
Detection guidance
- Inventory kernel versions across hosts and compare them against the affected ranges above.
- Review kernel logs for memory-corruption reports, such as unexpected oops or KASAN-style messages, on systems that mount SMB shares.
- Monitor for unexpected crashes of processes or kernel components that use SMB file operations.
Limitations of the available information
The record does not describe trigger conditions, reachable network paths or the precise effects of the memory corruption. It does not state a single fixed version covering all branches. The fixed-version interpretation of the ranges is an inference from the record's format.
Frequently asked questions
What is the root cause of CVE-2026-45972?
According to the record, error-handling variables are not cleared before SMB2_open() is retried in smb2_open_file(). This can lead to a use-after-free or a double free, depending on the state of the data pointer.
Is CVE-2026-45972 known to be actively exploited?
The record shows no CISA KEV listing and an SSVC exploitation value of none. No confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.