CVE-2026-64385: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64385 Overview

CVE-2026-64385 is a double-free vulnerability in the Linux kernel's SMB client code path handling SMB2_ioctl() replay operations. A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response buffer a second time.

The flaw resides in the smb: client subsystem and affects systems mounting remote shares over SMB2/SMB3. Exploitation targets kernel memory management, creating conditions for memory corruption during error recovery in the ioctl replay path.

Critical Impact
A double-free in kernel heap memory can be leveraged for privilege escalation or denial of service against Linux systems running SMB client workloads.

Affected Products

Linux kernel — SMB client (fs/smb/client) subsystem
Distributions shipping vulnerable kernel versions prior to the fix commits
Systems using SMB2/SMB3 client mounts (cifs.ko)

Discovery Timeline

2026-07-25 - CVE-2026-64385 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64385

Vulnerability Analysis

The vulnerability exists in the SMB2 ioctl replay logic within the Linux kernel's CIFS client. When an SMB2 IOCTL request is issued and receives a replayable error from the server, the response buffer is freed as part of the error handling path. The replay loop then attempts to reissue the request by calling SMB2_ioctl_init() to reinitialize the request structures.

If SMB2_ioctl_init() fails before the next send completes, the cleanup routine executes with stale response bookkeeping. The buffer type field still references the previously freed response, causing the cleanup path to invoke free on that already-released memory region. This results in a classic double-free condition [CWE-415] in kernel address space.

Double-free conditions in kernel heap allocators can corrupt slab metadata, enabling attackers to influence subsequent allocations. Skilled exploitation can pivot from memory corruption to arbitrary kernel write primitives.

Root Cause

The root cause is missing state reset between replay attempts. The response buffer pointer and buffer type variables are not cleared after the first free operation. When the retry path fails at initialization, the shared cleanup code cannot distinguish between a fresh allocation and a stale reference. The fix resets response bookkeeping before each attempt, ensuring cleanup only frees buffers that are actually live.

Attack Vector

An attacker controlling an SMB server, or capable of intercepting SMB traffic, can return crafted responses that trigger the replayable error path against a connected Linux client. Combined with resource pressure or a crafted follow-up condition that fails SMB2_ioctl_init(), the attacker induces the double-free. Local unprivileged users on multi-tenant systems may also trigger the path via ioctl operations against mounted SMB shares.

See the upstream kernel commit for the fix implementation.

Detection Methods for CVE-2026-64385

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing SMB2_ioctl, cifs_small_buf_release, or slab corruption warnings
Unexpected KASAN: double-free or slab-use-after-free reports on systems with kernel address sanitizer enabled
Repeated SMB2 IOCTL replay attempts followed by client-side crashes in /var/log/messages

Detection Strategies

Monitor kernel ring buffer for slab allocator errors and BUG: messages originating from the CIFS client module
Correlate SMB session errors with abnormal kernel process terminations on hosts mounting remote shares
Deploy kernel version inventory scanning to identify hosts running kernels prior to the patched commits

Monitoring Recommendations

Enable auditd rules covering mount operations for cifs/smb3 filesystem types and unusual ioctl syscall patterns
Forward kernel logs to a centralized logging platform for anomaly correlation across the fleet
Track outbound SMB connections to untrusted or unexpected destinations that could serve malicious responses

How to Mitigate CVE-2026-64385

Immediate Actions Required

Apply vendor-supplied kernel updates that include the upstream fix commits as soon as they are released for your distribution
Inventory all hosts mounting SMB shares and prioritize patching for systems connecting to shares outside the trust boundary
Restrict SMB client connections to authenticated, trusted file servers only

Patch Information

The fix resets response bookkeeping before each replay attempt to prevent the stale free. Patches have been merged to stable kernel branches through the following commits: 0be4bc64, 276c8efb, 96fcfc8a, f9bbadb6, and fc65ffb4. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

Unmount SMB shares from connections to untrusted servers until the kernel patch is deployed
Block outbound SMB traffic (TCP 445) at the network perimeter for hosts that do not require external SMB access
Where feasible, disable the CIFS kernel module (modprobe -r cifs) on systems that do not require SMB client functionality

bash

# Verify kernel version and check for the CIFS module
uname -r
lsmod | grep cifs

# Temporarily unload the CIFS module (requires no active mounts)
umount -a -t cifs
modprobe -r cifs

# Block outbound SMB at the host firewall
iptables -A OUTPUT -p tcp --dport 445 -j DROP