by Kastro
Paper/Archive/CVE-2026-64385

CVE-2026-64385

Linux Linux — smb: client: fix double-free in SMB2_ioctl() replay

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.6.396 × 207.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

Affected

ProductAffectedFixed inSource
Linux433042a91f9373241307725b52de573933ffedbf – < 0be4bc64882edaefaaee8d1e27d083643eb778e60be4bc64882edaefaaee8d1e27d083643eb778e6CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < 96fcfc8ae7359346156e492ca610e830d2649ad696fcfc8ae7359346156e492ca610e830d2649ad6CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < 276c8efbc49f9303ac76d0d4deab7128581b0f3b276c8efbc49f9303ac76d0d4deab7128581b0f3bCNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < fc65ffb4ef1bf540da16b17c225ae51091e07d72fc65ffb4ef1bf540da16b17c225ae51091e07d72CNA
Linux4f1fffa2376922f3d1d506e49c0fd445b023a28e – < f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9CNA
Linux6.6.32 – < 6.6.1456.6.145CNA
Linux6.86.6.145CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6refgit.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6refgit.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3brefgit.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72refgit.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9