CVE-2026-64597smb: client: fix double-free in SMB2_close() replay
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 433042a91f9373241307725b52de573933ffedbf before 037511726228aaf165c7067ff2bfc88eaecdf1f3; 4f1fffa2376922f3d1d506e49c0fd445b023a28e builds before 0aa97edf7c347c0f54e7e60c4740574b8120c66a; from 4f1fffa2376922f3d1d506e49c0fd445b023a28e before d15d83125007f673aec4323e1bbbaaffbe87ea13; from 4f1fffa2376922f3d1d506e49c0fd445b023a28e before b18ed621dbfceecea5539848cddcb9272c9a61e1; from 4f1fffa2376922f3d1d506e49c0fd445b023a28e before f96e1cdcb63ed3321142ff2fcdf784e32cda8fee; from 6.6.32 before 6.6.145 | CNA record |
References
- https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3
- https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a
- https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13
- https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1
- https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.