CVE-2026-64597 (GCVE-0-2026-64597)
Vulnerability from cvelistv5
Published
2026-08-06 07:13
Modified
2026-08-17 04:58
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
References
Impacted products
Vendor Product Version
Linux Linux Version: 433042a91f9373241307725b52de573933ffedbf
Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e
Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e
Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e
Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e
Version: 6.6.32   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "037511726228aaf165c7067ff2bfc88eaecdf1f3",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "0aa97edf7c347c0f54e7e60c4740574b8120c66a",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "d15d83125007f673aec4323e1bbbaaffbe87ea13",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "b18ed621dbfceecea5539848cddcb9272c9a61e1",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB server triggers the double-free via crafted SMB2 CLOSE responses over the network, returning replayable NTSTATUS values that map to -EAGAIN/-ECONNABORTED while leaving a response buffer for the client to free.\nAC:L - The attacking server controls both sides of the sequence by returning a replayable CLOSE status with a response buffer, then dropping or forcing reconnect so SMB2_close_init fails before the next send, and can repeat until the stale free occurs.\nPR:N - The attacking SMB endpoint needs no account or privileges on the victim client; once an SMB session and handle exist, the server alone drives the vulnerable CLOSE replay path.\nUI:N - On an already mounted or automounted share, background paths such as cached-directory close and cancelled-close work, as well as routine service file closes, can invoke SMB2_close without interactive user action at exploit time.\nS:U - The mempool double-free corrupts kernel memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - Double-free of a CIFS small/large response buffer can create overlapping live allocations and use-after-free reads, enabling disclosure of arbitrary kernel memory.\nI:H - Reallocation of the freed mempool object with attacker-controlled network data can corrupt live kernel objects or allocator metadata, enabling arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can immediately trigger allocator BUG diagnostics, heap corruption, oops, or panic, and the server can retrigger the path repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:19.742Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13"
        },
        {
          "url": "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_close() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64597",
    "datePublished": "2026-08-06T07:13:52.117Z",
    "dateReserved": "2026-07-19T15:36:31.799Z",
    "dateUpdated": "2026-08-17T04:58:19.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.