CVE-2026-64383: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64383 Overview

CVE-2026-64383 is a double-free vulnerability [CWE-415] in the Linux kernel's SMB (Server Message Block) client implementation. The flaw resides in the SMB2_flush() function, which retains response buffer bookkeeping across replay attempts. When a replayable flush response arrives and the subsequent retry fails before cifs_send_recv() stores a replacement response, the flush_exit cleanup path frees the stale response pointer a second time.

Critical Impact
A double-free in kernel space can lead to memory corruption, kernel crashes causing denial of service, and potential local privilege escalation if an attacker controls the freed allocation slot.

Affected Products

Linux kernel SMB client (fs/smb/client)
Distributions shipping vulnerable kernel builds prior to the referenced stable commits
Systems that mount remote shares via cifs.ko with SMB2/SMB3 replay semantics enabled

Discovery Timeline

2026-07-25 - CVE-2026-64383 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64383

Vulnerability Analysis

The SMB2_flush() function issues an SMB2 FLUSH request to persist file data on a remote server. When the transport layer signals that a response is replayable, the client repeats the request. The bug stems from persistent bookkeeping fields, specifically resp_buftype and rsp_iov, that are not reset at the top of the replay loop.

If the first attempt produces a response that must be replayed and the retry fails before cifs_send_recv() overwrites those fields, the cleanup label flush_exit observes a stale pointer that references an already-freed buffer. Freeing that pointer again produces a classic double-free condition inside the kernel slab allocator.

The fix reinitializes resp_buftype and rsp_iov at the top of each replay iteration. Cleanup then operates only on state produced by the current attempt, preserving normal handling of successful requests.

Root Cause

The root cause is improper lifecycle management of response buffer metadata across control-flow iterations. The function conflates state from a prior attempt with state expected by the exit cleanup, violating the invariant that flush_exit should only free buffers allocated by the current send.

Attack Vector

Exploitation requires interaction between a Linux SMB client and a server that returns a replayable flush response followed by a retry-time failure. A malicious or compromised SMB server can shape responses to force the client into the vulnerable replay path. Successful triggering corrupts kernel heap state and can crash the host or be chained toward escalation.

No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-64383

Indicators of Compromise

Kernel oops or panic messages referencing SMB2_flush, flush_exit, or smb2_free_rsp_buf in dmesg and /var/log/kern.log.
KASAN: double-free or slab-use-after-free reports naming SMB2 response buffers on kernels built with KASAN.
Repeated CIFS reconnect and replay events preceding an unexpected system reboot.

Detection Strategies

Monitor kernel ring buffer output for CIFS client warnings, replay retries, and slab allocator corruption traces.
Track SMB client sessions that connect to untrusted or externally reachable SMB servers, particularly across VPN and cloud file-share endpoints.
Correlate unexpected host reboots on Linux fleets that mount remote SMB shares with the presence of an unpatched cifs module.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized log platform for pattern analysis.
Alert on new SMB mount operations targeting servers outside an approved allow list.
Inventory running kernel versions across the fleet and flag hosts running builds that predate the fix commits.

How to Mitigate CVE-2026-64383

Immediate Actions Required

Apply the Linux kernel stable updates that include the fix commits and reboot affected systems.
Restrict outbound SMB (TCP 445) connections from Linux hosts to a defined allow list of trusted file servers.
Unmount and disable the cifs kernel module on Linux systems that do not require SMB client functionality.

Patch Information

The fix reinitializes resp_buftype and rsp_iov at the top of the replay loop in SMB2_flush(). Refer to the upstream stable commits: Kernel Git Commit 013a9a3, Kernel Git Commit 3407240, Kernel Git Commit 4be31c9, Kernel Git Commit 6e27f4, and Kernel Git Commit 8787571. Rebuild or install the vendor-supplied kernel package that incorporates these changes.

Workarounds

Avoid mounting SMB shares from untrusted servers until the kernel is patched.
Use host-based firewall rules to block egress to SMB endpoints outside the organization.
Prefer alternative protocols such as NFS or SSHFS for file sharing on unpatched Linux hosts where feasible.

bash

# Configuration example: block outbound SMB and unload the cifs module on unpatched hosts
sudo iptables -A OUTPUT -p tcp --dport 445 -j REJECT
sudo umount -a -t cifs
sudo modprobe -r cifs
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf