Junglewise Threat Intelligence

CVE-2026-64384: Linux Kernel double-free in SMB client change notify replay

CVE-2026-64384 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SMB client, which is used to connect to network file shares. Under specific error conditions during file change notifications, the system could attempt to free the same memory buffer twice. This could lead to system instability or a crash, potentially disrupting access to network storage.

Technical details

A double-free vulnerability exists in fs/smb/client/smb2pdu.c within the SMB2_change_notify function. When a response-bearing attempt returns a replayable error, it frees its response buffer; however, if SMB2_notify_init() fails before the subsequent send attempt, the cleanup routine incorrectly retains the previous buffer type and attempts to free the same buffer again. An attacker or a malfunctioning SMB server could potentially trigger this condition by inducing specific replayable errors. The fix involves resetting the response bookkeeping (resp_buftype and rsp_iov) before each replay attempt to prevent stale memory references.

Affected products

  • Linux Linux 6.6.32 to 6.6.145, 6.8 to 7.1.4

Timeline

  • 2026-07-25: disclosed: Initial publication of the CVE record.
  • 2026-07-25: patched: Fixes merged into various stable kernel branches.

References