Описание
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_ioctl() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_ioctl_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A double-free vulnerability exists in the SMB2_ioctl() replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted responses during an I/O control (ioctl) replay sequence. This could lead to a remote denial of service due to a kernel crash, and potentially allow for privilege escalation.
Отчет
A double-free flaw was found in the Linux kernel SMB (Server Message Block) client's SMB2_ioctl() replay path, which Red Hat rates as IMPORTANT. When an SMB2 ioctl attempt that received a response returns a replayable error, its response buffer is freed; if SMB2_ioctl_init() then fails before the next send attempt, the cleanup path retains the previous buffer type and frees that already-released response again. A malicious or compromised SMB server can exploit this by returning crafted responses during an ioctl replay sequence, causing a kernel crash (denial of service) and potentially privilege escalation on the client system. The Red Hat Enterprise Linux kernel and kernel-rt packages in the RHEL 9.6.z, 9.8.z, 9.9, 10.0.z, 10.2.z, and 10.3 streams are affected, and fixes are being pursued for those streams. The Red Hat In-Vehicle OS 2.0 and 2.1 kernels (kernel, kernel-rt, and kernel-ivos-qualcomm) are also affected. RHEL 6, RHEL 7, and RHEL 8, as well as RHEL 9.2 and 9.4, are not affected because the vulnerable code is not present in those kernels. Red Hat's severity of IMPORTANT (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) differs from the upstream CVE.org rating of CRITICAL (CVSS 9.8, AV:N/AC:L/PR:N) because exploitation requires a low-privileged local user to initiate an SMB connection to a malicious server and to reach a specific error-handling path during an ioctl replay, making the practical attack requirements more restrictive than the upstream assessment reflects.
Меры по смягчению последствий
This flaw is triggered when the kernel SMB client processes crafted responses from a malicious or compromised SMB server. As a workaround, avoid mounting or accessing SMB/CIFS shares from untrusted servers, and disconnect existing mounts from servers that are not fully trusted. A complete fix requires updating to a kernel that contains the fix once it is available for the affected stream.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:81406 | 12.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel | Fixed | RHSA-2026:77634 | 08.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:76739 | 08.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:76739 | 08.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
In the Linux kernel, the following vulnerability has been resolved: s ...
EPSS
7 High
CVSS3