CVE-2026-45972: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45972 Overview

CVE-2026-45972 is a Linux kernel vulnerability in the SMB client code. The flaw resides in the smb2_open_file() function within the kernel's smb: client subsystem. When SMB2_open() is retried, the @err_iov and @err_buftype variables are not zeroed out beforehand. This results in a potential use-after-free (UAF) condition when @data != NULL, or a double free otherwise. Both outcomes are memory-safety violations in kernel space. The issue has been resolved across multiple stable kernel branches via upstream commits.

Critical Impact
Memory corruption in the Linux kernel SMB client may lead to kernel instability, denial of service, or potential privilege escalation when mounting SMB shares.

Affected Products

Linux kernel — SMB client (fs/smb/client) subsystem
Stable kernel branches referenced by upstream fix commits
Systems mounting remote SMB2/SMB3 shares using the in-kernel CIFS/SMB client

Discovery Timeline

2026-05-27 - CVE-2026-45972 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45972

Vulnerability Analysis

The vulnerability is a memory-safety defect classified as a Use-After-Free [CWE-416] and Double Free [CWE-415] condition in the Linux kernel SMB client. It is triggered along the retry path inside smb2_open_file(). When the function retries an SMB2_open() operation, the local stack variables @err_iov (an iovec array describing error response buffers) and @err_buftype (buffer type metadata) retain values from the previous failed attempt.

If the retry succeeds and the caller passed @data != NULL, those stale buffer references may be dereferenced or returned to the caller after the underlying memory was already freed, producing a use-after-free. If @data is NULL, the same stale references can cause the kernel to call the buffer free routines a second time on already-released memory, producing a double free.

Root Cause

The root cause is missing reinitialization of error-path output variables between attempts. The fix zeroes out @err_iov and @err_buftype before retrying SMB2_open(), ensuring that no stale pointers or buffer-type identifiers survive across iterations. See the upstream commits referenced below for the precise patch hunks.

Attack Vector

Exploitation requires conditions that cause SMB2_open() to fail and be retried while the SMB client is mounted against a server that returns specific error responses. A malicious or compromised SMB server, or a man-in-the-middle on an unprotected SMB session, could shape responses to drive the client into the vulnerable retry path. Successful triggering corrupts kernel memory state, with impact ranging from kernel crash to potentially exploitable memory corruption.

No verified public exploit code is available. Refer to the upstream patches for technical detail:

Detection Methods for CVE-2026-45972

Indicators of Compromise

Unexplained kernel oops or panic traces referencing smb2_open_file, SMB2_open, or free_rsp_iov in stack traces.
KASAN reports flagging use-after-free or double-free in the fs/smb/client path.
Repeated SMB session reconnects or open-retry sequences logged against a specific remote server.

Detection Strategies

Compare running kernel version and build against the fixed stable branches referenced in the upstream commits.
Enable KASAN on test or canary systems mounting untrusted SMB shares to surface the bug class proactively.
Inspect dmesg and journalctl -k for CIFS or SMB client warnings correlated with mount or file-open operations.

Monitoring Recommendations

Monitor endpoints that mount SMB shares from untrusted networks for kernel crash dumps and reboot events.
Alert on SMB client errors emitted by the cifs kernel module under sustained retry conditions.
Track outbound SMB connections from Linux hosts to enforce a known allowlist of file servers.

How to Mitigate CVE-2026-45972

Immediate Actions Required

Identify Linux hosts running kernels that include the vulnerable smb2_open_file() retry path and mount SMB shares.
Apply the distribution kernel update that incorporates one of the upstream fix commits listed in the references.
Restrict SMB client connections to trusted, authenticated servers and require SMB signing and encryption.

Patch Information

The issue is fixed upstream by zeroing @err_iov and @err_buftype before retrying SMB2_open() in fs/smb/client. Backports are available across stable branches via commits 4d339b219004, 639deb962986, 7425453ea16d, 96e53bb3ee2f, e66dcf7bb9c4, and ebbbc4bfad4c. Update to a distribution kernel that includes one of these commits.

Workarounds

Unmount SMB shares on systems that cannot be patched immediately, and disable automatic SMB mounts in /etc/fstab and autofs.
Block outbound TCP/445 from Linux clients to any server not on an approved allowlist using host or network firewall rules.
Require SMB3 with signing and encryption (seal,sign) on remaining mounts to reduce exposure to malicious server responses.

bash

# Verify running kernel and check for the cifs module in use
uname -r
lsmod | grep -E '^cifs|^smb'

# Temporarily unload the SMB client where feasible
sudo umount -a -t cifs
sudo modprobe -r cifs

# Enforce signing and encryption on required mounts (example fstab entry)
# //server/share /mnt/share cifs credentials=/etc/smbcreds,seal,vers=3.1.1 0 0