CVE-2026-64385
smb: client: fix double-free in SMB2_ioctl() replay
Published Jul 25, 2026 · updated Oct 13, 2026
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
Timeline
Detection, updates, and resolution for this record.
Jul 25, 2026 · Catalog
Detected
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free
Oct 13, 2026 · Catalog
Fix available
Linux Kernel 0 → 6.6.145
Oct 13, 2026 · Catalog
Updated
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free
Affected
- Linux Kernel0 → 6.6.145