CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2flush() replay
SMB2flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv() stores a replacement response, flushexit will free the stale response pointer a second time.
Reinitialize respbuftype and rspiov at the top of the replay loop so cleanup only acts on response state produced by the current attempt. This fixes a double-free without changing replay handling for successful requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix so SMB2_flush() reinitializes resp_buftype and rsp_iov at the top of the SMB2_flush() replay loop, preventing a double-free caused by stale response pointer cleanup across replay attempts.
Linux kernel SMB client (SMB2_flush) Replay-loop response buffer bookkeeping = Reinitialize resp_buftype and rsp_iov at the top of the replay loop
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64383?
CVE-2026-64383 has a severity score of critical, rated at 9.8 on the CVSS scale.
How do I fix CVE-2026-64383?
To fix CVE-2026-64383, update your Linux kernel to the latest version that includes the security patch addressing this vulnerability.
What does CVE-2026-64383 affect?
CVE-2026-64383 affects the Linux kernel, specifically the SMB2_flush() function related to client-side operations.
What are the potential impacts of CVE-2026-64383?
The potential impacts of CVE-2026-64383 include data corruption and the risk of arbitrary code execution due to the double-free vulnerability.
When was CVE-2026-64383 published?
CVE-2026-64383 was published on July 25, 2026.