Описание
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_open() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_open_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A double-free vulnerability exists in the SMB2_open() replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same buffer again. This memory corruption vulnerability could potentially lead to a denial of service or, in some cases, arbitrary code execution.
Отчет
An IMPORTANT severity double-free flaw exists in the Linux kernel SMB client's SMB2_open() replay handling. When an SMB2 open attempt that received a response returns a replayable error, its response buffer is freed; if SMB2_open_init() then fails before the next send, the error cleanup retains stale response bookkeeping and frees the same buffer a second time. An attacker controlling a malicious SMB server can trigger this memory corruption when a local user or process connects to or mounts a share from that server, which can crash the kernel (denial of service) and potentially result in arbitrary code execution with kernel privileges. Red Hat Enterprise Linux 9 and 10 are affected in their current kernel update streams (including kernel-rt on RHEL 9), and Red Hat In-Vehicle OS 2.0 and 2.1 are affected through delegated kernel components, where fixes are being pursued. Earlier Red Hat Enterprise Linux releases (RHEL 6, 7, 8, and the RHEL 9.2 and 9.4 update streams) are not affected because the vulnerable code is not present in those kernels. Red Hat assigns this flaw a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N), lower than the upstream CVE record score of 8.8 (AV:N/AC:L/PR:N/UI:R); the difference reflects Red Hat's assessment that exploitation involves a local attack vector with high attack complexity rather than an easily exploitable network path.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:57251 | 20.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel | Fixed | RHSA-2026:69089 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:57252 | 20.08.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:57252 | 20.08.2026 |
Показывать по
Дополнительная информация
Статус:
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
In the Linux kernel, the following vulnerability has been resolved: s ...
7 High
CVSS3