CVE-2026-64382: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64382 Overview

CVE-2026-64382 is a double-free vulnerability in the Linux kernel's SMB client implementation. The flaw resides in the SMB2_open() replay path within the smb/client subsystem. A response-bearing attempt can return a replayable error and free its response buffer. When SMB2_open_init() fails before the next send, cleanup logic retains the previous buffer type and frees the same response buffer a second time.

The issue was resolved by resetting response bookkeeping before each retry attempt, preventing the stale free from occurring.

Critical Impact
A malicious or compromised SMB server can trigger kernel memory corruption on a connected Linux client, enabling denial of service and potentially privilege escalation via heap manipulation.

Affected Products

Linux kernel smb/client subsystem (CIFS/SMB2/SMB3 client)
Linux distributions shipping the vulnerable kernel versions prior to the referenced stable commits
Systems mounting SMB shares from untrusted or attacker-controlled servers

Discovery Timeline

2026-07-25 - CVE-2026-64382 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64382

Vulnerability Analysis

The vulnerability is a double-free [CWE-415] in the Linux kernel SMB client replay logic for SMB2_open() operations. SMB2 open requests can be retried when the server returns a replayable error. During the initial attempt, the client sends a compound request and receives a response buffer that is subsequently freed as part of error handling.

On retry, the client invokes SMB2_open_init() to rebuild the request. If this initialization fails before the next send is issued, the cleanup path executes with stale bookkeeping. The retained buffer type still references the previously freed response, and the cleanup logic frees that same buffer a second time.

The result is heap corruption within kernel address space. Because SMB traffic is triggered network-side, a malicious server can shape the sequence of replayable errors to hit the vulnerable window with high reliability.

Root Cause

The root cause is missing state reset between retry attempts in the SMB2 open replay path. Response bookkeeping fields, including the buffer type indicator, were not cleared after the first attempt freed its response buffer. When the second attempt failed early, cleanup used the stale metadata and called free on a pointer that no longer owned a valid allocation.

Attack Vector

Exploitation requires a Linux client to interact with a malicious or compromised SMB server. User interaction, such as mounting a share or accessing a file on an already-mounted share, is required to trigger the vulnerable code path. The attacker responds to SMB2_open requests with replayable errors and induces conditions that cause SMB2_open_init() to fail on the retry, triggering the double-free in kernel context.

No authenticated code examples or public proof-of-concept exploits are available for this issue at the time of publication. See the upstream fix commits for technical details on the vulnerable code path.

Detection Methods for CVE-2026-64382

Indicators of Compromise

Unexpected kernel panics or KASAN (Kernel Address Sanitizer) reports referencing SMB2_open, smb2_open_init, or cifs module symbols
dmesg entries showing double-free or slab corruption warnings correlated with SMB mount activity
SMB sessions from client hosts to untrusted or newly observed external SMB servers

Detection Strategies

Monitor kernel logs for slab allocator warnings and use-after-free style backtraces originating from the cifs.ko module
Inventory kernel versions across the Linux fleet and flag hosts running builds prior to the fixed stable releases referenced in the kernel commits
Correlate SMB client mount events (mount.cifs) with subsequent kernel instability on the same host

Monitoring Recommendations

Alert on outbound SMB (TCP/445) connections from Linux servers to non-approved destinations
Baseline expected SMB server endpoints per host and flag deviations
Enable persistent kernel log collection to a centralized SIEM for post-incident triage of crash traces

How to Mitigate CVE-2026-64382

Immediate Actions Required

Apply the upstream kernel patch or update to a distribution kernel that includes the fix commits
Restrict Linux SMB clients to trusted internal file servers using host or network firewall rules
Unmount SMB shares from untrusted sources until the patch is deployed

Patch Information

The fix resets response bookkeeping before each SMB2_open() retry attempt, preventing the stale buffer type from driving a second free. Stable kernel updates are available in the following commits: 02bc2896bdc3, 14498ff5ce0f, 3196b5192f24, b55e182f2324, and ff2d30927bc3. Rebuild affected distribution kernels or install vendor-provided packages that include these commits.

Workarounds

Block outbound TCP/445 and TCP/139 at the host firewall on systems that do not require SMB client functionality
Blacklist the cifs kernel module on hosts that have no operational requirement to mount SMB shares
Enforce network segmentation so that Linux clients cannot reach untrusted SMB endpoints

bash

# Prevent the cifs module from loading on hosts that do not require SMB client functionality
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf
echo 'install cifs /bin/true' | sudo tee -a /etc/modprobe.d/disable-cifs.conf
sudo update-initramfs -u

# Verify installed kernel version after patching
uname -r