CVE-2026-64382 (GCVE-0-2026-64382)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
Title
smb: client: fix double-free in SMB2_open() replay
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 433042a91f9373241307725b52de573933ffedbf , < 02bc2896bdc3e29362d6e40d404006944a159c25 (git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < 3196b5192f246df4272072f61a2f4a3e9967f55d (git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < 14498ff5ce0f272ce0ef988721413e06b7038972 (git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < ff2d30927bc3bf3c629f0768d2068096e64ef5ce (git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < b55e182f2324bc6a604c21a47aa6c448f719a532 (git)
Affected: 6.6.32 , < 6.6.145 (semver)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "02bc2896bdc3e29362d6e40d404006944a159c25",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "3196b5192f246df4272072f61a2f4a3e9967f55d",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "14498ff5ce0f272ce0ef988721413e06b7038972",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "ff2d30927bc3bf3c629f0768d2068096e64ef5ce",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "b55e182f2324bc6a604c21a47aa6c448f719a532",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_open() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_open_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB2/SMB3 server can trigger the flaw through network-delivered CREATE error responses after a victim mounts or accesses its share.\nAC:L - The server controls the replayable status and can disconnect or refuse reconnection so the next initialization fails; it can repeat the sequence to overcome scheduling variance.\nPR:N - The attacking server needs no account or privileges on the client, because the victim supplies the mounted SMB session and initiates the request.\nUI:R - A victim must mount the malicious share or perform an operation such as statfs, ACL access, notification, or file access that causes SMB2_open() to run.\nS:U - The double-free corrupts memory within the client kernel\u0027s existing security authority and does not inherently cross a VM or IOMMU boundary.\nC:H - The double-free can produce overlapping live SMB buffers and use-after-free access, supporting kernel-memory disclosure and arbitrary-read exploitation.\nI:H - Reallocation of the freed mempool object permits attacker-controlled network data to corrupt live kernel objects or allocator metadata, enabling arbitrary writes or control-flow hijacking.\nA:H - The double-free can immediately trigger allocator diagnostics or heap corruption leading to a kernel oops or panic, and the server can repeatedly retrigger it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:17.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/02bc2896bdc3e29362d6e40d404006944a159c25"
        },
        {
          "url": "https://git.kernel.org/stable/c/3196b5192f246df4272072f61a2f4a3e9967f55d"
        },
        {
          "url": "https://git.kernel.org/stable/c/14498ff5ce0f272ce0ef988721413e06b7038972"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff2d30927bc3bf3c629f0768d2068096e64ef5ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/b55e182f2324bc6a604c21a47aa6c448f719a532"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_open() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64382",
    "datePublished": "2026-07-25T08:50:31.937Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-05T12:41:17.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64382",
      "date": "2026-08-09",
      "epss": "0.00354",
      "percentile": "0.28127"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:45:10.000Z",
      "cve": "CVE-2026-64382",
      "id": "msrc_CVE-2026-64382",
      "initial_release_date": "2026-07-26T01:02:47.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix double-free in SMB2_open() replay",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64382.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64382\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:21.477\",\"lastModified\":\"2026-07-27T05:16:44.823\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix double-free in SMB2_open() replay\\n\\nA response-bearing attempt can return a replayable error and free its\\nresponse buffer. If SMB2_open_init() fails before the next send, cleanup\\nretains the previous buffer type and frees that response again.\\n\\nReset response bookkeeping before each attempt to prevent the stale free.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"433042a91f9373241307725b52de573933ffedbf\",\"lessThan\":\"02bc2896bdc3e29362d6e40d404006944a159c25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f1fffa2376922f3d1d506e49c0fd445b023a28e\",\"lessThan\":\"3196b5192f246df4272072f61a2f4a3e9967f55d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f1fffa2376922f3d1d506e49c0fd445b023a28e\",\"lessThan\":\"14498ff5ce0f272ce0ef988721413e06b7038972\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f1fffa2376922f3d1d506e49c0fd445b023a28e\",\"lessThan\":\"ff2d30927bc3bf3c629f0768d2068096e64ef5ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f1fffa2376922f3d1d506e49c0fd445b023a28e\",\"lessThan\":\"b55e182f2324bc6a604c21a47aa6c448f719a532\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.32\",\"lessThan\":\"6.6.145\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/02bc2896bdc3e29362d6e40d404006944a159c25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/14498ff5ce0f272ce0ef988721413e06b7038972\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3196b5192f246df4272072f61a2f4a3e9967f55d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b55e182f2324bc6a604c21a47aa6c448f719a532\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff2d30927bc3bf3c629f0768d2068096e64ef5ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-02T12:38:37+00:00",
      "cve": "CVE-2026-64382",
      "id": "CVE-2026-64382",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix double-free in SMB2_open() replay",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64382.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.