CVE-2026-64385 PUBLISHED

smb: client: fix double-free in SMB2_ioctl() replay

Assigner: Linux
Reserved: 19.07.2026 Published: 25.07.2026 Updated: 25.07.2026

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double-free in SMB2_ioctl() replay

A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 433042a91f9373241307725b52de573933ffedbf to 0be4bc64882edaefaaee8d1e27d083643eb778e6 (excl.)
  • affected from 4f1fffa2376922f3d1d506e49c0fd445b023a28e to 96fcfc8ae7359346156e492ca610e830d2649ad6 (excl.)
  • affected from 4f1fffa2376922f3d1d506e49c0fd445b023a28e to 276c8efbc49f9303ac76d0d4deab7128581b0f3b (excl.)
  • affected from 4f1fffa2376922f3d1d506e49c0fd445b023a28e to fc65ffb4ef1bf540da16b17c225ae51091e07d72 (excl.)
  • affected from 4f1fffa2376922f3d1d506e49c0fd445b023a28e to f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9 (excl.)
  • affected from 6.6.32 to 6.6.145 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.8 is affected
  • unaffected from 0 to 6.8 (excl.)
  • unaffected from 6.6.145 to 6.6.* (incl.)
  • unaffected from 6.12.96 to 6.12.* (incl.)
  • unaffected from 6.18.39 to 6.18.* (incl.)
  • unaffected from 7.1.4 to 7.1.* (incl.)
  • unaffected from 7.2-rc1 to * (incl.)

References