CVE-2026-64597
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel, the SMB client has a double-free vulnerability in SMB2_close() during replay. If a response-bearing attempt returns a replayable error and frees its response buffer, and then SMB2_close_init() fails before the next send, the buffer is freed again.
Risk Assessment
The double-free could lead to kernel memory corruption, potentially resulting in a system crash or privilege escalation by a remote attacker.
Recommendation
Apply the kernel patch that resets response bookkeeping before each attempt. Update the system to a patched kernel version.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.