# CVE-2024-46796: linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_se... CVE-2024-46796 is fixed in 26 products on 1 platform, first by DEBIAN-CVE-2024-46796, released September 18, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-46796 - Priority: High - CVSS: 7.8 (high) - EPSS: 0.0044 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 18, 2024 ## Description In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch run fstests generic/013 at 2024-09-02 19:48:59 ================================================================== BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200 Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176 CPU: 3 UID: 0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: cifsoplockd cifs_oplock_break [cifs] Call Trace: dump_stack_lvl+0x5d/0x80 ? detach_if_pending+0xab/0x200 print_report+0x156/0x4d9 ? detach_if_pending+0xab/0x200 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? detach_if_pending+0xab/0x200 kasan_report+0xda/0x110 ? detach_if_pending+0xab/0x200 detach_if_pending+0xab/0x200 timer_delete+0x96/0xe0 ? __pfx_timer_delete+0x10/0x10 ? rcu_is_watching+0x20/0x50 try_to_grab_pending+0x46/0x3b0 __cancel_work+0x89/0x1b0 ? __pfx___cancel_work+0x10/0x10 ? kasan_save_track+0x14/0x30 cifs_close_deferred_file+0x110/0x2c0 [cifs] ? __pfx_cifs_close_deferred_file+0x10/0x10 [cifs] ? __pfx_down_read+0x10/0x10 cifs_oplock_break+0x4c1/0xa50 [cifs] ? __pfx_cifs_oplock_break+0x10/0x10 [cifs] ? lock_is_held_type+0x85/0xf0 ? mark_held_locks+0x1a/0x90 process_one_work+0x4c6/0x9f0 ? find_held_lock+0x8a/0xa0 ? __pfx_process_one_work+0x10/0x10 ? lock_acquired+0x220/0x550 ? __list_add_valid_or_report+0x37/0x100 worker_thread+0x2e4/0x570 ? __kthread_parkme+0xd1/0xf0 ? __pfx_worker_thread+0x10/0x10 kthread+0x17f/0x1c0 ? kthread+0xda/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Allocated by task 1118: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 cifs_new_fileinfo+0xc8/0x9d0 [cifs] cifs_atomic_open+0x467/0x770 [cifs] lookup_open.isra.0+0x665/0x8b0 path_openat+0x4c3/0x1380 do_filp_open+0x167/0x270 do_sys_openat2+0x129/0x160 __x64_sys_creat+0xad/0xe0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 83: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 poison_slab_object+0xe9/0x160 __kasan_slab_free+0x32/0x50 kfree+0xf2/0x300 process_one_work+0x4c6/0x9f0 worker_thread+0x2e4/0x570 kthread+0x17f/0x1c0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x30/0x50 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x29/0xe0 __queue_work+0x5ea/0x760 queue_work_on+0x6d/0x90 _cifsFileInfo_put+0x3f6/0x770 [cifs] smb2_compound_op+0x911/0x3940 [cifs] smb2_set_path_size+0x228/0x270 [cifs] cifs_set_file_size+0x197/0x460 [cifs] cifs_setattr+0xd9c/0x14b0 [cifs] notify_change+0x4e3/0x740 do_truncate+0xfa/0x180 vfs_truncate+0x195/0x200 __x64_sys_truncate+0x109/0x150 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dtb-aarch64 opensuse-leap 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-64kb opensuse-leap 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-64kb sles 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-azure opensuse-leap 15.6 | 6.4.0-150600.8.34.2 | [SUSE-SU-2025:1177-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1177-1.md) | Apr 8, 2025 | | Linux | kernel-azure sles 15.6 | 6.4.0-150600.8.34.2 | [SUSE-SU-2025:1177-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1177-1.md) | Apr 8, 2025 | | Linux | kernel-coco sles 15.6 | 6.4.0-15061.21.coco15sp6.1 | [SUSE-SU-2025:01919-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01919-1.md) | Jun 12, 2025 | | Linux | kernel-coco_debug sles 15.6 | 6.4.0-15061.21.coco15sp6.1 | [SUSE-SU-2025:01919-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01919-1.md) | Jun 12, 2025 | | Linux | kernel-debug opensuse-leap 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-default opensuse-leap 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-default sles 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-default-base opensuse-leap 15.6 | 6.4.0-150600.23.47.2.150600.12.20.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-default-base sles 15.6 | 6.4.0-150600.23.47.2.150600.12.20.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-docs opensuse-leap 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-docs sles 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-kvmsmall opensuse-leap 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-livepatch-SLE15-SP6-RT_Update_10 sles 15.6 | 1-150600.1.5.1 | [SUSE-SU-2025:1178-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1178-1.md) | Apr 8, 2025 | | Linux | kernel-livepatch-SLE15-SP6_Update_10 sles 15.6 | 1-150600.13.5.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-obs-build opensuse-leap 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-obs-build sles 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-obs-qa opensuse-leap 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-rt opensuse-leap 15.6 | 6.4.0-150600.10.34.1 | [SUSE-SU-2025:1178-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1178-1.md) | Apr 8, 2025 | | Linux | kernel-rt_debug opensuse-leap 15.6 | 6.4.0-150600.10.34.1 | [SUSE-SU-2025:1178-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1178-1.md) | Apr 8, 2025 | | Linux | kernel-source opensuse-leap 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-source sles 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-source-azure opensuse-leap 15.6 | 6.4.0-150600.8.34.2 | [SUSE-SU-2025:1177-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1177-1.md) | Apr 8, 2025 | | Linux | kernel-source-azure sles 15.6 | 6.4.0-150600.8.34.2 | [SUSE-SU-2025:1177-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1177-1.md) | Apr 8, 2025 | | Linux | kernel-source-coco sles 15.6 | 6.4.0-15061.21.coco15sp6.1 | [SUSE-SU-2025:01919-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01919-1.md) | Jun 12, 2025 | | Linux | kernel-source-rt opensuse-leap 15.6 | 6.4.0-150600.10.34.1 | [SUSE-SU-2025:1178-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1178-1.md) | Apr 8, 2025 | | Linux | kernel-syms opensuse-leap 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-syms sles 15.6 | 6.4.0-150600.23.47.1 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-syms-azure opensuse-leap 15.6 | 6.4.0-150600.8.34.1 | [SUSE-SU-2025:1177-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1177-1.md) | Apr 8, 2025 | | Linux | kernel-syms-azure sles 15.6 | 6.4.0-150600.8.34.1 | [SUSE-SU-2025:1177-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1177-1.md) | Apr 8, 2025 | | Linux | kernel-syms-coco sles 15.6 | 6.4.0-15061.21.coco15sp6.1 | [SUSE-SU-2025:01919-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01919-1.md) | Jun 12, 2025 | | Linux | kernel-syms-rt opensuse-leap 15.6 | 6.4.0-150600.10.34.1 | [SUSE-SU-2025:1178-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1178-1.md) | Apr 8, 2025 | | Linux | kernel-zfcpdump opensuse-leap 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | kernel-zfcpdump sles 15.6 | 6.4.0-150600.23.47.2 | [SUSE-SU-2025:1180-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1180-1.md) | Apr 9, 2025 | | Linux | linux Debian 13.5 (trixie) | 6.10.11-1 | [DEBIAN-CVE-2024-46796](https://patchblox.com/security/data/fix/linux/debian-cve-2024-46796.md) | Sep 18, 2024 | | Linux | linux Debian 14 | 6.10.11-1 | [DEBIAN-CVE-2024-46796](https://patchblox.com/security/data/fix/linux/debian-cve-2024-46796.md) | Sep 18, 2024 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.