The Linux kernel SMB client had a double-free vulnerability in the SMB2_ioctl() function caused by replayable error responses that free the response buffer twice if SMB2_ioctl_init() fails before the next send. This improper memory management could lead to system instability or exploitation. The issue affects Linux kernel versions prior to 7.0.0-31.31 and several related builds for Ubuntu 24.04 LTS hardware enablement edge kernels. The vulnerability is rated with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote network attack with no privileges required and high impact on confidentiality, integrity, and availability. Ubuntu has released patches in updated kernel packages and advises users to update and reboot. Due to ABI changes, recompilation of third-party kernel modules is required after update.

This vulnerability allows a remote attacker to cause a double-free condition in the SMB client code of the Linux kernel, potentially leading to memory corruption, system crashes, or privilege escalation. The CVSS score of 9.8 reflects critical impact on system confidentiality, integrity, and availability. Exploitation does not require privileges or user interaction. No known exploits in the wild have been reported at this time.

A patch is available from Ubuntu as part of the Linux kernel updates for the affected versions. Users should apply the updates to the linux-hwe-edge kernel packages and reboot their systems to complete remediation. Due to an ABI change, recompilation and reinstallation of any third-party kernel modules is necessary after updating. Follow the vendor advisory instructions for updating to the fixed package versions.