CVE-2024-46736
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In the SMB client in the Linux kernel, there is a double put of @cfile in smb2_rename_path(). If smb2_set_path_attr() is called with a valid @cfile and returns -EINVAL, the reference of @cfile was already dropped by a previous smb2_compound_op() call, leading to a double put.
Risk Assessment
A double put can lead to memory corruption, system crash, or potential code execution. This is a serious vulnerability in the SMB client.
Recommendation
Update the Linux kernel to a version with the fix that resolves the double put issue in smb2_rename_path().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the reference of @cfile was already dropped by previous smb2_compound_op() call.