CVE-2026-64387 addresses a double-free vulnerability in the Linux kernel SMB client implementation. Specifically, a response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next send, the cleanup process retains the previous buffer type and frees that response again, causing a double-free. The fix resets response bookkeeping before each attempt to prevent freeing stale buffers. This vulnerability affects multiple linux-hwe-edge kernel versions prior to 7.0.0-31.31 and related builds. The vulnerability has been patched in updated Linux kernel packages as per Ubuntu security advisories USN-8726-1 and USN-8727-1. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a critical remote code execution or system compromise risk if exploited.

Successful exploitation of this vulnerability could lead to memory corruption due to double-free conditions, potentially allowing an attacker to execute arbitrary code, escalate privileges, or cause denial of service. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

A patch is available and has been released by Ubuntu in the linux-hwe-edge kernel packages. Users should update their systems to the fixed versions and reboot to apply the changes. Due to an ABI change in the kernel update, recompilation and reinstallation of any third-party kernel modules is required. Follow the vendor advisory instructions for updating to the specified package versions to fully remediate the vulnerability.