CVE-2026-31608: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31608 is a double-free vulnerability in the Linux kernel's SMB server component (ksmbd), specifically in the smb_direct_free_sendmsg function. The flaw arises because smb_direct_flush_send_list() already calls smb_direct_free_sendmsg() to release resources, but the code incorrectly attempts to free the same memory again after post_sendmsg() moves the message to the batch list. Affected Linux kernel versions include all releases before 6.18.24, 6.19.x before 6.19.14, and 7.0.x before 7.0.1. It was published on April 24, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-415 (Double Free) and CWE-1341 (Multiple Releases of Same Resource or Handle). In the Linux kernel's SMB Direct (RDMA-based SMB transport) server code, smb_direct_flush_send_list() invokes smb_direct_free_sendmsg() to release send message buffers. However, after post_sendmsg() moves a message to the batch list, the code path calls smb_direct_free_sendmsg() a second time on the already-freed memory, resulting in a double-free condition. This type of memory corruption bug can be triggered remotely via crafted SMB sendmsg operations without requiring authentication, given the network-accessible nature of the SMB server component (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this double-free vulnerability can result in kernel panic (denial of service), memory corruption, or potential privilege escalation on affected systems. Because the flaw resides in the kernel's SMB server component and is reachable without authentication, a remote attacker on the local network could trigger the condition by sending specially crafted SMB requests, potentially destabilizing or fully compromising the host. The high confidentiality, integrity, and availability impact scores reflect the risk of full kernel-level compromise (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.017% (0.000170), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Patches are available in Linux kernel versions 6.18.24, 6.19.14, and 7.0.1. The fix prevents the double-free by ensuring smb_direct_free_sendmsg() is not called a second time after post_sendmsg() moves the message to the batch list. Relevant upstream commits include 6968c91fab05, 2ba03f46132b, 830de6eeb9db, and 84ff995ae826. Users should apply the latest stable kernel update from their distribution as soon as possible. If immediate patching is not feasible, restricting network access to SMB services and implementing network-level segmentation can reduce exposure (GitHub Advisory, Red Hat Bugzilla).