CVE-2026-45972CWE-416CWE-825

CVE-2026-45972

Critical · published May 27, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF and double free in smb2_open_file()

Zero out @err_iov and @err_buftype before retrying SMB2_open() to

prevent an UAF bug if @data != NULL, otherwise a double free.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weaknesses
CWE-416 · Use After Free; CWE-825 · Expired Pointer Dereference
Published
2026-05-27T18:17Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.1.163, < 6.1.1656.1.165
linux/linux_kernel≥ 6.6.124, < 6.6.1286.6.128
linux/linux_kernel≥ 6.12.70, < 6.12.756.12.75
linux/linux_kernel≥ 6.18.10, < 6.18.146.18.14
linux/linux_kernel≥ 6.19.1, < 6.19.46.19.4
linux/linux_kernelall versions—
References (9)
https://git.kernel.org/stable/c/4d339b219004869e96c4ce56b8891f83a38da4c0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/639deb962986ef2f5e2a6d5a600c66f922471e81 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7425453ea16dbc3bbb0f6cac4d60b537e5e4d151 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/96e53bb3ee2f354cf6b4ab07bcc56e500f8b3f74 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e66dcf7bb9c4df5582c82bc3582725abcbfbea73 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ebbbc4bfad4cb355d17c671223d0814ee3ef4eda · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://access.redhat.com/security/cve/CVE-2026-45972 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2481973 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45972.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 27 MAY 12:18Z
    smb: client: fix potential UAF and double free in smb2_open_file()
    cvelistv5