CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2ioctl() replay
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Compensating control
Reset SMB2 response bookkeeping before each replay attempt so a failed SMB2_ioctl_init() cannot retain the previous buffer type and free the response buffer again.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64385?
CVE-2026-64385 has a critical severity score of 9.8.
How do I fix CVE-2026-64385?
To fix CVE-2026-64385, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2026-64385?
CVE-2026-64385 affects the Linux kernel that implements the SMB2 protocol.
What type of vulnerability is CVE-2026-64385?
CVE-2026-64385 is a double-free vulnerability in the SMB2_ioctl() function of the Linux kernel.
What are the potential consequences of exploiting CVE-2026-64385?
Exploiting CVE-2026-64385 could allow an attacker to execute arbitrary code or crash the affected system.