---
id: CVE-2026-45972
title: 'smb: client: fix potential UAF and double free in smb2_open_file()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix potential UAF and double free in smb2_open_file()

  Zero out @err_iov and @err_buftype before retrying SMB2_open() to
  prevent an UAF bug if @data != NUL…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 743f70406264348c0830f38409eb6c40a42fb2db <
    96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74
  - >-
    Linux >= 3a6d6b332f92990958602c1e35ce0173e2dd62e9 <
    7425453ea16dbc3bbb0f6cac4d60b537e5e4d151
  - >-
    Linux >= b64e3b5d8d759dd4333992e4ba4dadf9359952c8 <
    4d339b219004869e96c4ce56b8891f83a38da4c0
  - >-
    Linux >= 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 <
    e66dcf7bb9c4df5582c82bc3582725abcbfbea73
  - >-
    Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 <
    639deb962986ef2f5e2a6d5a600c66f922471e81
  - >-
    Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 <
    ebbbc4bfad4cb355d17c671223d0814ee3ef4eda
  - Linux >= 6.1.163 < 6.1.165
  - Linux >= 6.6.124 < 6.6.128
  - Linux >= 6.12.70 < 6.12.75
  - Linux >= 6.18.10 < 6.18.14
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:18:43.156960Z'
published: '2026-05-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:47.985Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45972'
references:
  - url: 'https://git.kernel.org/stable/c/96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74'
  - url: 'https://git.kernel.org/stable/c/7425453ea16dbc3bbb0f6cac4d60b537e5e4d151'
  - url: 'https://git.kernel.org/stable/c/4d339b219004869e96c4ce56b8891f83a38da4c0'
  - url: 'https://git.kernel.org/stable/c/e66dcf7bb9c4df5582c82bc3582725abcbfbea73'
  - url: 'https://git.kernel.org/stable/c/639deb962986ef2f5e2a6d5a600c66f922471e81'
  - url: 'https://git.kernel.org/stable/c/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda'
tags:
  - cve.org
epss: 0.00329
epssPercentile: 0.24426
ingestedAt: '2026-10-16T17:24:46.702Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF and double free in smb2_open_file()

Zero out @err_iov and @err_buftype before retrying SMB2_open() to
prevent an UAF bug if @data != NULL, otherwise a double free.

## Affected

- `Linux >= 743f70406264348c0830f38409eb6c40a42fb2db < 96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74`
- `Linux >= 3a6d6b332f92990958602c1e35ce0173e2dd62e9 < 7425453ea16dbc3bbb0f6cac4d60b537e5e4d151`
- `Linux >= b64e3b5d8d759dd4333992e4ba4dadf9359952c8 < 4d339b219004869e96c4ce56b8891f83a38da4c0`
- `Linux >= 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 < e66dcf7bb9c4df5582c82bc3582725abcbfbea73`
- `Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 < 639deb962986ef2f5e2a6d5a600c66f922471e81`
- `Linux >= e3a43633023e3cacaca60d4b8972d084a2b06236 < ebbbc4bfad4cb355d17c671223d0814ee3ef4eda`
- `Linux >= 6.1.163 < 6.1.165`
- `Linux >= 6.6.124 < 6.6.128`
- `Linux >= 6.12.70 < 6.12.75`
- `Linux >= 6.18.10 < 6.18.14`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.