Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-64385

smb: client: fix double-free in SMB2_ioctl() replay

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 433042a91f9373241307725b52de573933ffedbf to < 0be4bc64882edaefaaee8d1e27d083643eb778e6affected
  • 4f1fffa2376922f3d1d506e49c0fd445b023a28e to < 96fcfc8ae7359346156e492ca610e830d2649ad6affected
  • 4f1fffa2376922f3d1d506e49c0fd445b023a28e to < 276c8efbc49f9303ac76d0d4deab7128581b0f3baffected
  • 4f1fffa2376922f3d1d506e49c0fd445b023a28e to < fc65ffb4ef1bf540da16b17c225ae51091e07d72affected
  • 4f1fffa2376922f3d1d506e49c0fd445b023a28e to < f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9affected
  • 6.6.32 to < 6.6.145affected

Linux Linux

Default version status: affected

  • 6.8affected
  • 0 to < 6.8unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.96 to ≤ 6.12.*unaffected
  • 6.18.39 to ≤ 6.18.*unaffected
  • 7.1.4 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References