Junglewise Threat Intelligence

CVE-2026-64387: Linux Kernel SMB client double-free in query directory replay

CVE-2026-64387 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SMB client, which is used to connect to Windows-style file shares. Under specific error conditions when browsing directories, the system could attempt to free the same memory buffer twice. This type of memory management error typically leads to a system crash (kernel panic), potentially causing a denial of service for the affected machine.

Technical details

A double-free vulnerability exists in the Linux kernel SMB client within 'fs/smb/client/smb2pdu.c'. The issue occurs when a response-bearing attempt returns a replayable error and frees its response buffer. If 'SMB2_query_directory_init()' fails before the subsequent retry, the cleanup routine incorrectly retains the previous buffer type and attempts to free the already-freed response buffer again. This is caused by a failure to reset response bookkeeping before each replay attempt. Attackers could potentially trigger this via a malicious or malfunctioning SMB server to cause a kernel oops or denial of service. Patches have been released for various stable branches including 6.6.x, 6.12.x, 6.18.x, and 7.1.x.

Affected products

  • Linux Linux Kernel 6.8 to 7.1.4, 6.6.32 to 6.6.145

Timeline

  • 2026-07-25: disclosed
  • 2026-07-25: advisory

References

Related threats