Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-64385Double-free in Linux kernel SMB client

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

View on NVD

Analysis

A critical double-free vulnerability in the Linux kernel SMB client (SMB2_ioctl) allows for potential memory corruption and system crashes. This affects Linux systems mounting remote SMB shares, posing a risk of remote code execution or privilege escalation.

Relevant roles

LinuxCyberSecurityCloudBackendDockerC

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH

EPSS

Probability of exploitation (next 30 days): 0.0017 (0.2%)
Percentile: 6.4%
EPSS: 2026-07-26

Technical description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

Published: 7/25/2026, 10:17:21 AM
Last modified: 7/27/2026, 5:16:45 AM

References

HomeEventsBlogResourcesCoursesTeam