CyberSecBulletin
CVE-2026-31444NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-31444 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 9e785f004cbc56390479b77375726ea9b0d1a8a6, 7de55bba69cbf0f9280daaea385daf08bc076121, a5c6f6d6ceefed2d5210ee420fb75f8362461f46 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.45% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 9e785f004cbc56390479b77375726ea9b0d1a8a6 or 7de55bba69cbf0f9280daaea385daf08bc076121 or a5c6f6d6ceefed2d5210ee420fb75f8362461f46 or 6d7e5a918c1d0aad06db0e17677b66fc9a471021, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.12.80 or 6.18.21 or 6.19.11, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux302fef75512b2c8329a3f5efab1ae7ba2562387a up to, but not including, 9e785f004cbc56390479b77375726ea9b0d1a8a6; 08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c up to, but not including, 7de55bba69cbf0f9280daaea385daf08bc076121; 1d6abf145615dbfe267ce3b0a271f95e3780e18e up to, but not including, a5c6f6d6ceefed2d5210ee420fb75f8362461f46; ce8507ee82c888126d8e7565e27c016308d24cde up to, but not including, 6d7e5a918c1d0aad06db0e17677b66fc9a471021; 1dfd062caa165ec9d7ee0823087930f3ab8a6294 up to, but not including, 48623ec358c1c600fa1e38368746f933e0f1a617; 6.6.130 up to, but not including, 6.6.131; 6.12.78 up to, but not including, 6.12.80; 6.18.19 up to, but not including, 6.18.21; and 1 more ranges9e785f004cbc56390479b77375726ea9b0d1a8a6, 7de55bba69cbf0f9280daaea385daf08bc076121, a5c6f6d6ceefed2d5210ee420fb75f8362461f46, 6d7e5a918c1d0aad06db0e17677b66fc9a471021, 48623ec358c1c600fa1e38368746f933e0f1a617, 6.6.131
LinuxLinux Kernel6.12.78 up to, but not including, 6.12.80; 6.18.19 up to, but not including, 6.18.21; 6.19.9 up to, but not including, 6.19.11; 6.6.130; 7.06.12.80, 6.18.21, 6.19.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_grant_oplock() has two issues in the oplock publication sequence: 1) opinfo is linked into ci->m_op_list (via opinfo_add) before add_lease_global_list() is called. If add_lease_global_list() fails (kmalloc returns NULL), the error path frees the opinfo via __free_opinfo() while it is still linked in ci->m_op_list. Concurrent m_op_list readers (opinfo_get_list, or direct iteration in smb_break_all_levII_oplock) dereference the freed node. 2) opinfo->o_fp is assigned after add_lease_global_list() publishes the opinfo on the global lease list. A concurrent find_same_lease_key() can walk the lease list and dereference opinfo->o_fp->f_ci while o_fp is still NULL. Fix by restructuring the publication sequence to eliminate post-publish failure: - Set opinfo->o_fp before any list publication (fixes NULL deref). - Preallocate lease_table via alloc_lease_table() before opinfo_add() so add_lease_global_list() becomes infallible after publication. - Keep the original m_op_list publication order (opinfo_add before lease list) so concurrent opens via same_client_has_lease() and opinfo_get_list() still see the in-flight grant. - Use opinfo_put() instead of __free_opinfo() on err_out so that the RCU-deferred free path is used. This also requires splitting add_lease_global_list() to take a preallocated lease_table and changing its return type from int to void, since it can no longer fail.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.