CVE-2026-64385 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_ioctl() replay
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability resides in the Linux kernel's SMB client implementation where a double-free condition can occur during SMB2_ioctl() operation handling. The flaw manifests when an SMB request receives a response that indicates it can be replayed, leading to the freeing of its response buffer. However, if subsequent operations within SMB2_ioctl_init() fail before the next send attempt, the cleanup process retains the previous buffer type information and attempts to free the same memory region again, resulting in a double-free scenario.
The technical implementation issue stems from improper state management within the SMB client's error handling pathway. When an initial request fails or requires replay, the response buffer gets freed as part of normal cleanup procedures. The vulnerability occurs because the response bookkeeping structures are not properly reset between successive send attempts, allowing stale buffer references to persist. This creates a scenario where the same memory location gets deallocated twice, potentially leading to memory corruption and arbitrary code execution privileges.
The operational impact of this vulnerability extends beyond simple memory corruption, as it can be exploited to achieve privilege escalation or system instability within environments that rely on SMB client functionality. Attackers could leverage this double-free condition to manipulate heap memory layout, potentially executing malicious code with elevated privileges. The vulnerability affects systems running Linux kernels with SMB client implementations and poses significant risk in enterprise environments where SMB protocol usage is prevalent for file sharing and network operations.
Mitigation strategies should focus on proper buffer state management and ensuring that response bookkeeping structures are reset appropriately before each send attempt. System administrators should prioritize kernel updates to versions containing the fix that properly resets response tracking information between replay attempts. Additionally, implementing robust memory safety checks and heap integrity monitoring can help detect and prevent exploitation of similar double-free conditions in other kernel subsystems.
This vulnerability aligns with CWE-415, which addresses double free conditions in software systems where memory is freed twice, and relates to ATT&CK technique T1068, involving privilege escalation through kernel exploits. The fix implementation demonstrates proper defensive programming practices by ensuring that resource cleanup operations are properly synchronized with state transitions. Such vulnerabilities highlight the critical importance of careful memory management in kernel-space code, particularly in protocol implementations where error recovery paths may involve complex state transitions and resource deallocation sequences.