CVE-2026-64386 - Vulnerability Details

- smb: client: fix query_info() replay double-free

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix query_info() replay double-free

A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_info_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

Published: 2026-07-25

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a double‑free bug in the Linux kernel SMB client that is triggered when query_info fails and returns a replayable error. A response buffer is freed twice, which corrupts kernel memory. This can cause a kernel panic, disrupt services, and lead to denial of service.

Affected Systems

The affected systems are Linux kernel versions 6.8 and the release candidates 6.8‑rc2 through 6.8‑rc7, plus all other Linux kernel releases as indicated by the CPE data.

Risk and Exploitability

The EPSS score below 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.8 reflects a severe impact. The likely attack vector is network‑based via the SMB protocol; a malicious or misconfigured SMB server could trigger the error path and double‑free the client buffer. No documented remote code execution or privilege escalation is recorded for this issue.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`433042a91f9373241307725b52de573933ffedbf`	affected	< 100fb7c455fa86d248b8bd7bb9de757c192870b4
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 3c81dda84799f76b42aec598564316e2964440db
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< f1add4acb656f5a82806a1ab0e63fed3d8b1bfca
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 89234773e8348918111aa15f6922b58cf3843364
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 2a88561d66eb855813cf004a0abe648bbb17de5e
`6.6.32`	affected	< 6.6.145

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.8:-::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[433042a91f9373241307725b52de573933ffedbf,100fb7c455fa86d248b8bd7bb9de757c192870b4)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,3c81dda84799f76b42aec598564316e2964440db)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,f1add4acb656f5a82806a1ab0e63fed3d8b1bfca)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,89234773e8348918111aa15f6922b58cf3843364)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,2a88561d66eb855813cf004a0abe648bbb17de5e)`	affected	code_commit	—
`[6.6.32,6.6.145)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	semver	—
`[0,6.8)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel release that contains the SMB client double‑free fix (the patch can be found in the referenced kernel commits).
If an immediate kernel upgrade is not possible, disable SMBv2 client functionality or restrict SMB traffic to trusted hosts until the patch is applied.
Monitor system logs for kernel panics or crashes related to SMB client operations, and configure alerts to detect such events promptly.

Generated by OpenCVE AI on September 5, 2026 at 00:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00457.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4
https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e
https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db
https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364
https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca
https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64386-9e73@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64386
https://www.cve.org/CVERecord?id=CVE-2026-64386

History

Fri, 04 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415
CPEs		cpe:2.3:o:linux:linux_kernel:6.8:-:::::: cpe:2.3:o:linux:linux_kernel:6.8:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.8:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.8:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.8:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.8:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.8:rc7::::::

Wed, 05 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-415

Mon, 03 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64386-9e73@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64386 https://www.cve.org/CVERecord?id=CVE-2026-64386
Metrics	threat_severity `None`	threat_severity `Important`

Sun, 02 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415

Sat, 01 Aug 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 26 Jul 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
Title		smb: client: fix query_info() replay double-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4 https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364 https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:34.729Z

Updated: 2026-08-17T04:54:38.353Z

Reserved: 2026-07-19T15:36:31.784Z

Link: CVE-2026-64386

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:21.917

Modified: 2026-09-04T20:44:23.587

Link: CVE-2026-64386

Redhat

Severity : Important

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64386 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-05T00:45:05Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle
CWE-415
Double Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object