CVE-2024-46736

What it actually does

Double put of cfile reference in smb2_rename_path after smb2_set_path_attr returns -EINVAL, causing use-after-free of the writable path structure in the SMB client.

Why it matters to the business

Kernel memory corruption on Linux systems using SMB shares may lead to crashes, denial of service, or local privilege escalation, affecting server uptime and requiring urgent patching across fleets.

How an attack unfolds

An attacker with access to trigger SMB2 rename operations causes smb2_compound_op to drop the cfile reference, then reuses the freed structure when cifs_get_writable_path is not re-invoked, enabling memory corruption in the Linux kernel SMB client.

How to fix it

Upgrade the Linux kernel to version 6.6.51 or apply the commit b27ea9c96efd2c252a981fb00d0f001b86c90f3e; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is at least 6.6.51, confirm the patch is present in the SMB client source, and test rename operations under error conditions to ensure no double-put occurs.

Typical attack path

1. Establish SMB connection to target
2. Issue rename path operation that hits -EINVAL in smb2_set_path_attr
3. Trigger subsequent use of the already-dropped cfile reference
4. Exploit resulting use-after-free for corruption or code execution

How to detect it

Search kernel logs and dmesg for oops or slab-use-after-free messages involving cifs or smb2_rename_path; correlate with SMB traffic spikes or rename attempts near the time of the event.

What your security team should do

• Prioritize kernel upgrade to 6.6.51 on all SMB client systems
• Review and restrict unnecessary SMB access for untrusted users
• Monitor kernel logs for use-after-free warnings in cifs module
• Track EPSS and exploit maturity updates for this issue