CVE-2026-64384: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64384 Overview

CVE-2026-64384 is a double-free vulnerability in the Linux kernel's SMB client code path handling change notification replay. When a response-bearing attempt returns a replayable error, the kernel frees its response buffer. If SMB2_notify_init() subsequently fails before the next send, cleanup logic retains the previous buffer type and frees the same response a second time. The upstream fix resets response bookkeeping before each attempt to prevent the stale free. The flaw affects Linux kernel builds that include the cifs/smb client module and interact with SMB servers.

Critical Impact
A double-free in kernel memory can lead to memory corruption, denial of service, or potential privilege escalation on hosts using the Linux SMB client.

Affected Products

Linux kernel smb/cifs client (upstream)
Distributions shipping vulnerable kernels prior to the referenced stable commits
Systems mounting remote SMB shares via the in-kernel SMB client

Discovery Timeline

2026-07-25 - CVE-2026-64384 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64384

Vulnerability Analysis

The vulnerability lives in the Linux kernel SMB client change-notify replay path. Change notifications allow clients to be informed of directory modifications on an SMB server. The client sends the notify request using SMB2_notify_init() and processes the server response through common request/response bookkeeping.

When a request returns a replayable error, the client frees the associated response buffer as part of its retry logic. The retry path then attempts to re-initialize the notify request. If SMB2_notify_init() fails before the next send is issued, the generic cleanup code runs against stale bookkeeping. Because the previous response buffer type is retained, cleanup treats the already-freed buffer as live and frees it again.

A double-free of an SMB response buffer corrupts kernel heap metadata. Depending on allocator state and slab layout, the outcome ranges from a kernel panic to controlled memory reuse suitable for privilege escalation.

Root Cause

The root cause is missing state reset between retry attempts in the change-notify replay loop. Response bookkeeping fields, including buffer type, carry over from the failed attempt. The fix reinitializes those fields at the start of each attempt so cleanup cannot act on a previously freed buffer.

Attack Vector

Exploitation requires that the target host mount or otherwise communicate with an SMB share whose server can return a replayable error to a change-notify request. A malicious or compromised SMB server, or an on-path attacker able to influence SMB responses, can drive the client into the retry path and trigger the double-free. See the upstream commits 145f820d, 52af1975, 5821f9db, 90189151, and d684f413 for the applied fix.

Detection Methods for CVE-2026-64384

Indicators of Compromise

Kernel oops or panic messages referencing cifs, smb2_notify, or slab double-free warnings in dmesg
Sudden termination of processes holding SMB mounts, followed by kernel taint flags
KASAN: double-free or SLUB: double free reports on kernels built with memory sanitizers

Detection Strategies

Inventory running kernel versions and compare against the fixed stable branches referenced in the upstream commits
Monitor kernel logs for repeated SMB retry sequences immediately preceding memory allocator warnings
Alert on unexpected reboots or crashes on file servers and workstations that mount SMB shares

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a central logging system for pattern analysis
Track outbound SMB traffic to unfamiliar or untrusted servers from Linux hosts
Enable kernel crash dump collection (kdump) to capture forensic evidence if the flaw is triggered

How to Mitigate CVE-2026-64384

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that incorporates the referenced upstream commits
Reboot affected systems after patching to load the corrected cifs/smb client module
Restrict Linux clients to trusted SMB servers on segmented networks until patches are deployed

Patch Information

The fix resets response bookkeeping at the start of each notify attempt so cleanup after a failed SMB2_notify_init() cannot re-free a previously released buffer. The change is applied across multiple stable branches in commits 145f820d, 52af1975, 5821f9db, 90189151, and d684f413 in the mainline and stable kernel trees.

Workarounds

Unmount SMB shares (umount -a -t cifs) on hosts that cannot be patched immediately
Block outbound TCP/445 to untrusted destinations at the host or network firewall
Disable automatic SMB mounts in /etc/fstab and switch to alternative protocols where feasible

bash

# Configuration example: temporarily block outbound SMB and unmount shares
sudo umount -a -t cifs
sudo iptables -A OUTPUT -p tcp --dport 445 -j REJECT
sudo iptables -A OUTPUT -p tcp --dport 139 -j REJECT
# After patching, verify the running kernel includes the fix
uname -r