CVE-2026-64383

Analyzed Analyzed - Analysis Complete

Double-Free in Linux Kernel SMB Client

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, flush_exit will free the stale response pointer a second time. Reinitialize resp_buftype and rsp_iov at the top of the replay loop so cleanup only acts on response state produced by the current attempt. This fixes a double-free without changing replay handling for successful requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64383

EUVD

EUVD-2026-48927

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	6.8
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.6.32 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.8.1 (inc) to 6.12.96 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in the Linux kernel's SMB client implementation. It occurs in the SMB2_flush() function during replay attempts. When a retry fails after receiving a replayable flush response, the function incorrectly frees a stale response pointer twice, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct detection commands. Monitor kernel logs for crashes or errors related to SMB operations, particularly flush operations. Check for double-free errors in system logs after SMB operations.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code on a system running a vulnerable Linux kernel with SMB client functionality enabled.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue in the SMB client that could lead to memory corruption via a double-free error, but no evidence suggests it impacts data protection, access controls, or audit logging required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using SMB client features until the update is applied. If immediate patching is not possible, restrict access to SMB shares or disable SMB client functionality temporarily.

Hi! I’m here to help you understand CVE-2026-64383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70