CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2ioctl() replay
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64385?
CVE-2026-64385 has a critical severity score of 9.8.
How do I fix CVE-2026-64385?
To fix CVE-2026-64385, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2026-64385?
CVE-2026-64385 affects the Linux kernel that implements the SMB2 protocol.
What type of vulnerability is CVE-2026-64385?
CVE-2026-64385 is a double-free vulnerability in the SMB2_ioctl() function of the Linux kernel.
What are the potential consequences of exploiting CVE-2026-64385?
Exploiting CVE-2026-64385 could allow an attacker to execute arbitrary code or crash the affected system.