In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can… (CVE-2026-64384)
A double-free vulnerability in the Linux kernel SMB client was resolved. The issue occurs when a response-bearing attempt returns a replayable error and frees its response buffer, but if SMB2_notify_init() fails before the next send, the cleanup process frees the same response buffer again due to stale bookkeeping. This can lead to memory corruption. The fix involves resetting response bookkeeping before each attempt to prevent double-free errors.
AI Analysis
Technical Summary
The Linux kernel SMB client had a double-free vulnerability triggered by replayable errors during change notify operations. Specifically, if SMB2_notify_init() fails before sending the next request, the cleanup routine mistakenly frees a previously freed response buffer again because it retains stale buffer type information. This flaw could cause memory corruption due to double-free. The vulnerability was addressed by resetting the response bookkeeping state before each attempt to avoid freeing stale buffers multiple times.
Potential Impact
This vulnerability can cause memory corruption in the Linux kernel SMB client due to a double-free condition. Memory corruption in kernel space may lead to system instability or potential escalation of privileges depending on exploitation context. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to remediate the issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor's advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can… (CVE-2026-64384)
Description
A double-free vulnerability in the Linux kernel SMB client was resolved. The issue occurs when a response-bearing attempt returns a replayable error and frees its response buffer, but if SMB2_notify_init() fails before the next send, the cleanup process frees the same response buffer again due to stale bookkeeping. This can lead to memory corruption. The fix involves resetting response bookkeeping before each attempt to prevent double-free errors.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel SMB client had a double-free vulnerability triggered by replayable errors during change notify operations. Specifically, if SMB2_notify_init() fails before sending the next request, the cleanup routine mistakenly frees a previously freed response buffer again because it retains stale buffer type information. This flaw could cause memory corruption due to double-free. The vulnerability was addressed by resetting the response bookkeeping state before each attempt to avoid freeing stale buffers multiple times.
Potential Impact
This vulnerability can cause memory corruption in the Linux kernel SMB client due to a double-free condition. Memory corruption in kernel space may lead to system instability or potential escalation of privileges depending on exploitation context. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to remediate the issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor's advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hwgg-8wxq-m5c5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64384"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420b9c2644c7f808474d
Added to database: 07/25/2026, 23:08:59 UTC
Last enriched: 07/25/2026, 23:28:39 UTC
Last updated: 07/26/2026, 03:42:33 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.