CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-10-19
Weakness: CWE-415

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, flush_exit will free the stale response pointer a second time. Reinitialize resp_buftype and rsp_iov at the top of the replay loop so cleanup only acts on response state produced by the current attempt. This fixes a double-free without changing replay handling for successful requests.

Affected products

Linux kernel: from 6.6.32 before 6.6.145; from 6.8.1 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 6.8, 6.8-rc2, 6.8-rc3, 6.8-rc4, 6.8-rc5, 6.8-rc6 (+1) — fixed in 6.12.96, 6.18.39, 6.6.145, 7.1.4

How to fix

Upgrade to a fixed version: Linux kernel 6.12.96, 6.18.39, 6.6.145, 7.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64383 or the next vulnerability affects your stack