Junglewise Threat Intelligence

CVE-2026-64385: Linux Kernel double-free in SMB2_ioctl replay

CVE-2026-64385 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's SMB client, which is used to connect to network file shares. Under specific error conditions during a file operation, the system may attempt to free the same memory buffer twice. This can lead to a system crash or instability, potentially disrupting access to network storage and impacting business operations.

Technical details

A double-free vulnerability exists in the Linux kernel's SMB client (cifs.ko) within the SMB2_ioctl() function. When a request attempt returns a replayable error, the response buffer is freed. If a subsequent call to SMB2_ioctl_init() fails before the next transmission, the cleanup routine incorrectly retains the previous buffer type and attempts to free the already-freed response buffer again. This occurs because response bookkeeping is not reset between replay attempts. The fix involves resetting the response buffer type and zeroing the response I/O vector at the start of each replay attempt. Patches are available in various stable kernel branches including 6.6.145, 6.12.96, 6.18.39, and 7.1.4.

Affected products

  • Linux Linux 6.6.32 to 6.6.145, 6.8 to 7.1.4

Timeline

  • 2026-07-25: disclosed
  • 2026-07-25: advisory

References