In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential cfid UAF in smb2queryinfocompound

When smb2queryinfocompound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free.

Reinitialize cfid to NULL under the replay label.

Example trace (trimmed):

refcountt: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcountwarnsaturate+0x9c/0x110 [...] RIP: 0010:refcountwarnsaturate+0x9c/0x110 [...] Call Trace: <TASK> smb2queryinfocompound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? stepinto+0x10d/0x690 ? legitimizepath+0x28/0x60 smb2queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmemcachealloc+0x18a/0x340 ? getnameflags+0x46/0x1e0 cifsstatfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfsbydentry+0x67/0x90 vfsstatfs+0x16/0xd0 userstatfs+0x54/0xa0 dosysstatfs+0x20/0x50 dosyscall64+0x58/0x80