{"id":"CVE-2026-45972","title":"smb: client: fix potential UAF and double free in smb2_open_file()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF and double free in smb2_open_file()\n\nZero out @err_iov and @err_buftype before retrying SMB2_open() to\nprevent an UAF bug if @data != NUL…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 743f70406264348c0830f38409eb6c40a42fb2db < 96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74","Linux >= 3a6d6b332f92990958602c1e35ce0173e2dd62e9 < 7425453ea16dbc3bbb0f6cac4d60b537e5e4d151","Linux >= b64e3b5d8d759dd4333992e4ba4dadf9359952c8 < 4d339b219004869e96c4ce56b8891f83a38da4c0","Linux >= 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 < e66dcf7bb9c4df5582c82bc3582725abcbfbea73","Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 < 639deb962986ef2f5e2a6d5a600c66f922471e81","Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 < ebbbc4bfad4cb355d17c671223d0814ee3ef4eda","Linux >= 6.1.163 < 6.1.165","Linux >= 6.6.124 < 6.6.128","Linux >= 6.12.70 < 6.12.75","Linux >= 6.18.10 < 6.18.14","Linux 6.19"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:18:43.156960Z"},"published":"2026-05-27","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:47.985Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45972","references":[{"url":"https://git.kernel.org/stable/c/96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74"},{"url":"https://git.kernel.org/stable/c/7425453ea16dbc3bbb0f6cac4d60b537e5e4d151"},{"url":"https://git.kernel.org/stable/c/4d339b219004869e96c4ce56b8891f83a38da4c0"},{"url":"https://git.kernel.org/stable/c/e66dcf7bb9c4df5582c82bc3582725abcbfbea73"},{"url":"https://git.kernel.org/stable/c/639deb962986ef2f5e2a6d5a600c66f922471e81"},{"url":"https://git.kernel.org/stable/c/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda"}],"tags":["cve.org"],"epss":0.00329,"epssPercentile":0.24426,"ingestedAt":"2026-10-16T17:24:46.702Z","slug":"CVE-2026-45972","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF and double free in smb2_open_file()\n\nZero out @err_iov and @err_buftype before retrying SMB2_open() to\nprevent an UAF bug if @data != NULL, otherwise a double free.\n\n## Affected\n\n- `Linux >= 743f70406264348c0830f38409eb6c40a42fb2db < 96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74`\n- `Linux >= 3a6d6b332f92990958602c1e35ce0173e2dd62e9 < 7425453ea16dbc3bbb0f6cac4d60b537e5e4d151`\n- `Linux >= b64e3b5d8d759dd4333992e4ba4dadf9359952c8 < 4d339b219004869e96c4ce56b8891f83a38da4c0`\n- `Linux >= 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 < e66dcf7bb9c4df5582c82bc3582725abcbfbea73`\n- `Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 < 639deb962986ef2f5e2a6d5a600c66f922471e81`\n- `Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 < ebbbc4bfad4cb355d17c671223d0814ee3ef4eda`\n- `Linux >= 6.1.163 < 6.1.165`\n- `Linux >= 6.6.124 < 6.6.128`\n- `Linux >= 6.12.70 < 6.12.75`\n- `Linux >= 6.18.10 < 6.18.14`\n- `Linux 6.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}