PT-2026-34960 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31608

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the SMB server component. The function smb direct flush send list() already invokes smb direct free sendmsg(), leading to a second call to smb direct free sendmsg() after post sendmsg() moves the item to the batch list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-31608

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 73

• https://security-tracker.debian.org/tracker/CVE-2026-31608 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31608 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31608 · Security Note
• https://git.kernel.org/stable/c/830de6eeb9db4cb7e758201fb99328ef4ca4b032 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://git.kernel.org/stable/c/6968c91fab05b8fc4d6700e0cf34472bb422df25 · Patch
• https://git.kernel.org/stable/c/84ff995ae826aa6bbcc6c7b9ea569ff67c021d72 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31608 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31608 · Vendor Advisory
• https://git.kernel.org/stable/c/2ba03f46132b0d1a7bafb86e1ef61951a2254023 · Patch
• https://suse.com/security/cve/CVE-2026-31612 · Note
• https://suse.com/security/cve/CVE-2026-31604 · Note
• https://suse.com/security/cve/CVE-2026-31787 · Note
• https://suse.com/security/cve/CVE-2026-31599 · Note