PT-2024-32159 · Linux+2 · Linux Kernel+2
Published
2024-09-03
·
Updated
2025-06-12
·
CVE-2024-46736
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.52
Description
The issue is related to a double put of
@cfile in smb2 rename path(). When smb2 set path attr() is called with a valid @cfile and returns -EINVAL, it is necessary to call cifs get writable path() again because the reference of @cfile was already dropped by the previous smb2 compound op() call.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.52 or later. As a temporary workaround, consider restricting the use of the
smb2 rename path() function until a patch is available. Additionally, avoid using the smb2 set path attr() function with a valid @cfile that may return -EINVAL, as this can cause the reference of @cfile to be dropped prematurely.Exploit
Fix
Improper Resource Release
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Red Os
Suse