PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45972 Linux CVE debrief

A use-after-free (UAF) and double-free vulnerability exists in the Linux kernel's SMB client implementation, specifically within the smb2_open_file() function. The flaw occurs when retrying SMB2_open() operations: if the @data pointer is non-NULL, uninitialized @err_iov and @err_buftype variables can lead to memory corruption. The fix zeroes out these variables before retry to prevent both UAF and double-free conditions. This vulnerability affects SMB client operations and could potentially be exploited for privilege escalation or system instability.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-07-15
Advisory published
2026-05-27
Advisory updated
2026-07-15

Who should care

Linux system administrators, kernel maintainers, organizations using SMB/CIFS client functionality, security teams monitoring kernel vulnerabilities

Technical summary

The smb2_open_file() function in the Linux kernel SMB client fails to initialize @err_iov and @err_buftype before retrying SMB2_open(). When @data != NULL, this leads to use-after-free and double-free vulnerabilities. The fix ensures these variables are zeroed before retry operations. Multiple stable kernel branches have received patches.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches when available
  • Monitor distribution security advisories for updated kernel packages
  • Restrict SMB client access to trusted servers until patched
  • Enable kernel memory sanitizers (KASAN/KMSAN) in test environments to detect UAF conditions

Evidence notes

CVE published 2026-05-27T14:17:14.173Z; modified 2026-05-27T14:48:03.013Z. Six kernel.org stable branch commits provided as references. NVD status: Awaiting Analysis. No CVSS score or severity assigned at time of publication.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45972 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45972

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45972 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45972

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4d339b219004869e96c4ce56b8891f83a38da4c0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/639deb962986ef2f5e2a6d5a600c66f922471e81

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7425453ea16dbc3bbb0f6cac4d60b537e5e4d151

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e66dcf7bb9c4df5582c82bc3582725abcbfbea73

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.