by Kastro
Paper/Archive/CVE-2026-64384

CVE-2026-64384

Linux Linux — smb: client: fix change notify replay double-free

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.6.396 × 207.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

Affected

ProductAffectedFixed inSource
Linux433042a91f9373241307725b52de573933ffedbf – < 5821f9dbb8b5b24391850a13418e633edd0fb0035821f9dbb8b5b24391850a13418e633edd0fb003CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < d684f4134998085702009b94c35c2003fc9e72d3d684f4134998085702009b94c35c2003fc9e72d3CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < 52af1975f0dfae990c5a0e85872cc41be0e88a6852af1975f0dfae990c5a0e85872cc41be0e88a68CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < 901891513951bc8322ece754863909ea45af95c6901891513951bc8322ece754863909ea45af95c6CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < 145f820dcbb2cced374f2532f8a61a44dce4a615145f820dcbb2cced374f2532f8a61a44dce4a615CNA
Linux6.6.32 – < 6.6.1456.6.145CNA
Linux6.86.6.145CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/5821f9dbb8b5b24391850a13418e633edd0fb003refgit.kernel.org/stable/c/d684f4134998085702009b94c35c2003fc9e72d3refgit.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68refgit.kernel.org/stable/c/901891513951bc8322ece754863909ea45af95c6refgit.kernel.org/stable/c/145f820dcbb2cced374f2532f8a61a44dce4a615