CVE-2026-64387 - Vulnerability Details

- smb: client: fix query directory replay double-free

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix query directory replay double-free

A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_directory_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

Published: 2026-07-25

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s SMB client contains a double‑free bug when a query directory operation receives a replayable error. The bug frees the same response buffer twice, resulting in memory corruption. The weakness is identified as CWE‑1341 (Improper Validation of Self‑Input).

Affected Systems

All Linux systems running a kernel that includes the SMB client implementation prior to the fixed commit are potentially affected. The CNA lists the vendor as Linux and the product as Linux kernel, but no specific version range is provided, so any kernel lacking the fix could be vulnerable.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a malicious or faulty SMB server that triggers the replayable error, which could be used by an attacker who can communicate with the vulnerable client.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`433042a91f9373241307725b52de573933ffedbf`	affected	< 3409aedf3c81a810243da94164f6621c9d205c98
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 1665f25b1dea30bf2d02e16245d203a944c9d994
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 00b0fa425941438b664950a8ee65dfba2def4336
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 3317a5d015fca976475aa71df224056777316fde
`4f1fffa2376922f3d1d506e49c0fd445b023a28e`	affected	< 9647492b5e41954be59d5157eddbcd4cdc1656f7
`6.6.32`	affected	< 6.6.145

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[433042a91f9373241307725b52de573933ffedbf,3409aedf3c81a810243da94164f6621c9d205c98)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,1665f25b1dea30bf2d02e16245d203a944c9d994)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,00b0fa425941438b664950a8ee65dfba2def4336)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,3317a5d015fca976475aa71df224056777316fde)`	affected	code_commit	—
`[4f1fffa2376922f3d1d506e49c0fd445b023a28e,9647492b5e41954be59d5157eddbcd4cdc1656f7)`	affected	code_commit	—
`[6.6.32,6.6.145)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	semver	—
`[0,6.8)`	unaffected	semver	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 00b0fa4, which restores correct response bookkeeping and prevents the double free.
Apply any pending security updates or patches from the distribution that incorporate the latest Linux kernel fixes.
If the SMB client is not required for your environment, consider disabling it or removing the corresponding kernel modules to reduce the attack surface while a patch is applied.

Generated by OpenCVE AI on August 5, 2026 at 00:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00457.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336
https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994
https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde
https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98
https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7
https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64387-ff1a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64387
https://www.cve.org/CVERecord?id=CVE-2026-64387

History

Tue, 04 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-415

Thu, 30 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64387-ff1a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64387 https://www.cve.org/CVERecord?id=CVE-2026-64387
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
Title		smb: client: fix query directory replay double-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336 https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994 https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98 https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:35.543Z

Updated: 2026-08-05T12:41:24.033Z

Reserved: 2026-07-19T15:36:31.784Z

Link: CVE-2026-64387

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:22.020

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64387

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64387 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T00:45:03Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object