CVE-2022-3595

What it actually does

Double-free vulnerability in sess_free_buffer() within fs/cifs/sess.c allows repeated freeing of the same kernel buffer during CIFS session teardown, resulting in memory corruption.

Why it matters to the business

Linux systems using CIFS/SMB file shares may experience kernel panics or denial-of-service conditions; the large number of downstream kernel dependents increases the operational blast radius for unpatched distributions.

How an attack unfolds

A local attacker with low privileges crafts or manipulates CIFS session operations so that sess_free_buffer is invoked twice on the same buffer; the resulting use-after-free or heap corruption leads to a crash. No public exploits or threat-actor campaigns are known.

How to fix it

Upgrade the Linux kernel to the commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 or later; rebuild and reboot affected systems. Where immediate patching is not possible, disable unnecessary CIFS mounts or restrict local user access.

How to confirm the fix worked

Verify the running kernel contains commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 via git log or kernel version string; attempt to reproduce the original double-free path under controlled conditions to confirm absence of the flaw.

Typical attack path

1. Obtain local shell or user-level access on a Linux host with CIFS client enabled
2. Trigger CIFS session establishment and teardown sequences that exercise sess_free_buffer
3. Cause the double-free condition through repeated or malformed session operations
4. Observe kernel panic or system reboot

How to detect it

Review kernel crash logs (dmesg, /var/log/kern.log) for repeated entries referencing sess_free_buffer or cifs session teardown; correlate with CIFS mount activity immediately preceding the crash.

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-user Linux systems that mount CIFS shares
• Monitor upstream distribution advisories for backported fixes
• Temporarily restrict local accounts that can trigger CIFS operations if patching is delayed
• Reboot after applying the fix to load the corrected kernel binary