CVE-2026-64382 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_open() replay
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the Linux kernel's SMB client implementation where a double-free condition can occur during SMB2_open() operation replay scenarios. The flaw manifests when a response-bearing operation returns a replayable error while simultaneously freeing its response buffer, creating a scenario where subsequent cleanup operations attempt to free the same memory region twice. This represents a classic memory safety issue that can lead to system instability or potential exploitation.
The technical root cause stems from improper response buffer management within the SMB2_open() function's retry logic. When SMB2_open_init() fails before proceeding to the next send operation, the cleanup routine retains the previous buffer type information and attempts to free that same buffer again. This occurs because the response bookkeeping state is not properly reset between consecutive attempt cycles, leading to a stale reference being processed during cleanup operations. The vulnerability specifically affects the client-side SMB implementation and demonstrates poor state management during error recovery scenarios.
The operational impact of this double-free vulnerability extends beyond simple memory corruption, potentially enabling denial of service conditions or more severe exploitation depending on system configuration. An attacker could potentially trigger this condition through malformed SMB responses or network interruptions that cause the client to retry operations, leading to memory corruption that might be exploitable under certain circumstances. The vulnerability affects systems running Linux kernels with SMB client functionality and represents a failure in proper resource management during error recovery paths.
Mitigation strategies should focus on ensuring proper response bookkeeping reset before each new attempt cycle within the SMB2_open() function. This requires implementing state cleanup routines that properly reset buffer tracking information between retry attempts, preventing stale references from persisting across operation cycles. Security patches should include validation of buffer states and explicit reset operations before attempting to free memory resources. The fix aligns with common security practices for preventing double-free vulnerabilities and demonstrates the importance of proper resource management in network protocol implementations. This vulnerability type maps to CWE-415, which addresses improper handling of double-free conditions, and could potentially be leveraged through ATT&CK techniques related to privilege escalation or denial of service.
The fix implementation involves modifying the SMB2_open() function to reset response bookkeeping data structures before each new attempt, ensuring that cleanup operations only process currently valid buffer references. This approach prevents the reuse of stale buffer pointers and eliminates the double-free condition by maintaining proper state isolation between operation attempts. System administrators should prioritize applying kernel updates containing this fix while monitoring for potential system stability issues related to SMB client functionality during the update process.