---
id: CVE-2026-31609
title: >-
  smb: client: avoid double-free in smbd_free_send_io() after
  smbd_send_batch_flush()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  smb: client: avoid double-free in smbd_free_send_io() after
  smbd_send_batch_flush()


  smbd_send_batch_flush() already calls smbd_free_send_io(),

  so we should not call it…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cca0526ef2344cab6944d7f441fc24e152da031b <
    a9940dcbe5cb92482c04efc7341039ddf7dbf607
  - >-
    Linux >= 37b5c06956183b65e6808b509cf637632016cdf7 <
    22b7c1c619d808aec4cad3dc42103345e370d107
  - >-
    Linux >= 21538121efe6c8c5b51c742fa02cbe820bc48714 <
    f9a162c2bbcd0ac85bd07c5b37cf20286048b65c
  - >-
    Linux >= 21538121efe6c8c5b51c742fa02cbe820bc48714 <
    27b7c3e916218b5eb2ee350211140e961bfc49be
  - Linux >= 6.18.11 < 6.18.24
  - Linux >= 6.19.1 < 6.19.14
  - Linux 7.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:11:13.445840Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:16.904Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31609'
references:
  - url: 'https://git.kernel.org/stable/c/a9940dcbe5cb92482c04efc7341039ddf7dbf607'
  - url: 'https://git.kernel.org/stable/c/22b7c1c619d808aec4cad3dc42103345e370d107'
  - url: 'https://git.kernel.org/stable/c/f9a162c2bbcd0ac85bd07c5b37cf20286048b65c'
  - url: 'https://git.kernel.org/stable/c/27b7c3e916218b5eb2ee350211140e961bfc49be'
tags:
  - cve.org
epss: 0.00671
epssPercentile: 0.51032
ingestedAt: '2026-10-16T17:24:46.663Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

smbd_send_batch_flush() already calls smbd_free_send_io(),
so we should not call it again after smbd_post_send()
moved it to the batch list.

## Affected

- `Linux >= cca0526ef2344cab6944d7f441fc24e152da031b < a9940dcbe5cb92482c04efc7341039ddf7dbf607`
- `Linux >= 37b5c06956183b65e6808b509cf637632016cdf7 < 22b7c1c619d808aec4cad3dc42103345e370d107`
- `Linux >= 21538121efe6c8c5b51c742fa02cbe820bc48714 < f9a162c2bbcd0ac85bd07c5b37cf20286048b65c`
- `Linux >= 21538121efe6c8c5b51c742fa02cbe820bc48714 < 27b7c3e916218b5eb2ee350211140e961bfc49be`
- `Linux >= 6.18.11 < 6.18.24`
- `Linux >= 6.19.1 < 6.19.14`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.