Critical severity · published Apr 24, 2026
CVE-2026-31608
smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(),
so we should not call it again after post_sendmsg()
moved it to the batch list.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
before 6.18.24; 6.19 before 6.19.14; 7.0 before 7.0.1 · source: NVD
LI
Linux · Linux
5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7 before 6968c91fab05b8fc4d6700e0cf34472bb422df25; 79242e7b6bc63efec28b7c235bc320806afce6c0 before 2ba03f46132b0d1a7bafb86e1ef61951a2254023; 34abd408c8ba24d7c97bd02ba874d8c714f49db1 before 830de6eeb9db4cb7e758201fb99328ef4ca4b032; 34abd408c8ba24d7c97bd02ba874d8c714f49db1 before 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72; 6.18.11 before 6.18.24; 6.19.1 before 6.19.14; +1 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-31608
Patch
https://git.kernel.org/stable/c/2ba03f46132b0d1a7bafb86e1ef61951a2254023
Patch
https://git.kernel.org/stable/c/6968c91fab05b8fc4d6700e0cf34472bb422df25
Patch
https://git.kernel.org/stable/c/830de6eeb9db4cb7e758201fb99328ef4ca4b032
Patch
https://git.kernel.org/stable/c/84ff995ae826aa6bbcc6c7b9ea569ff67c021d72
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability