CVE-2024-46736: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2024-46736) has been identified and resolved in the SMB client component. The issue specifically affects the smb2_rename_path() function where a double put of @cfile occurs. This vulnerability was discovered in September 2024 and affects the Linux kernel's SMB client implementation (Kernel Git).

The vulnerability occurs when smb2_set_path_attr() is called with a valid @cfile and returns -EINVAL. In this scenario, the reference of @cfile is already dropped by the previous smb2_compound_op() call, but the code fails to call cifs_get_writable_path() again, leading to a potential double-free condition. This issue was introduced by commit 71f15c90e785 ("smb: client: retry compound request without reusing lease") (Kernel Git).

The vulnerability could potentially lead to memory corruption due to the double-free of the @cfile reference. This type of issue can result in system instability or potentially be exploited for privilege escalation, though no specific exploits have been reported in the wild.

The issue has been fixed by adding a call to cifs_get_writable_path() when smb2_set_path_attr() returns -EINVAL. The fix ensures proper reference counting by obtaining a new reference to @cfile before the retry attempt. Users should update to the patched version of the Linux kernel that includes the fix (Kernel Git).