CVE-2026-31608

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg() moved it to the batch list.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

VendorProductVersions
LinuxLinux>= 5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7, < 6968c91fab05b8fc4d6700e0cf34472bb422df25; >= 79242e7b6bc63efec28b7c235bc320806afce6c0, < 2ba03f46132b0d1a7bafb86e1ef61951a2254023; >= 34abd408c8ba24d7c97bd02ba874d8c714f49db1, < 830de6eeb9db4cb7e758201fb99328ef4ca4b032; >= 34abd408c8ba24d7c97bd02ba874d8c714f49db1, < 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72; >= 6.18.11, < 6.18.24; >= 6.19.1, < 6.19.14
LinuxLinux7.0

References

Timeline

Published
Apr 24, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-316099.8In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_bCVE-2026-31617.5IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly CVE-2026-316105.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc TCVE-2026-316118.6In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_daclCVE-2026-316127.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2_get_ea() smb2_get_ea() reads ea_rCVE-2026-316138.1In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATCVE-2026-316147.1In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds cCVE-2026-316155.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: renesas_usb3: validate endpoint index in standard request CVE-2026-316165.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() A CVE-2026-316175.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() TheCVE-2026-316185.5In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like cCVE-2026-316195.5In the Linux kernel, the following vulnerability has been resolved: ALSA: fireworks: bound device-supplied status before string array looku
CVE-2026-31608: Critical severity, CVSS 9.8 | Vulnix