CVE-2026-64386: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64386 Overview

CVE-2026-64386 is a double-free vulnerability in the Linux kernel's SMB (Server Message Block) client implementation. The flaw resides in the query_info() replay path, where a response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup logic retains the previous buffer type and frees the same response buffer a second time.

The issue affects systems mounting remote SMB shares using the in-kernel cifs.ko client. Exploitation of a kernel double-free can lead to memory corruption, denial of service, or potentially privilege escalation depending on heap state and allocator behavior.

Critical Impact
A malicious or compromised SMB server can trigger a double-free in the Linux SMB client, causing kernel memory corruption that may result in denial of service or code execution in kernel context.

Affected Products

Linux kernel SMB client (fs/smb/client)
Linux distributions shipping vulnerable stable kernel branches referenced in the upstream fix commits
Systems mounting SMB/CIFS shares using the in-kernel client

Discovery Timeline

2026-07-25 - CVE-2026-64386 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64386

Vulnerability Analysis

The vulnerability lives in the Linux kernel SMB client's query_info() implementation. During an SMB2 QUERY_INFO operation, the client may issue a request, receive a response buffer, and then encounter a replayable error condition. In that path, the response buffer is freed as part of error handling.

The replay logic then attempts a new send. If SMB2_query_info_init() fails before the next network transmission, subsequent cleanup consults stale bookkeeping. It observes the previous buffer type and invokes the free routine on a response pointer that was already released.

This stale-state double-free corrupts kernel slab allocator metadata. Depending on timing and heap layout, an attacker who controls the server side can influence which object occupies the freed slot, enabling more serious memory-safety consequences than a simple crash.

Root Cause

The root cause is missing state reset between retry attempts in the query_info() replay loop. Response buffer bookkeeping (buffer type and pointer references used by the SMB response cleanup routine) is not cleared after the first successful response is freed. When initialization of the retry fails early, cleanup treats stale metadata as valid and frees the already-released buffer a second time. This is a classic double-free flaw [CWE-415] rooted in unsynchronized error paths.

Attack Vector

Exploitation requires the victim system to communicate with an attacker-influenced SMB server. A malicious server can craft response sequences that induce replayable errors during QUERY_INFO handling, then manipulate follow-up conditions so that SMB2_query_info_init() fails before the next send. Once the double-free fires, the attacker can attempt heap grooming against the SMB client's allocator pool to convert memory corruption into a more useful primitive.

The upstream fix resets response bookkeeping before each attempt in the retry loop, so the cleanup routine no longer sees stale buffer metadata. The patch was distributed across five stable kernel commits. See the kernel.org fix commit for the code change.

Detection Methods for CVE-2026-64386

Indicators of Compromise

Unexpected kernel oops or panic messages referencing cifs, smb2_query_info, or slab allocator corruption in dmesg and /var/log/kern.log
KASAN reports flagging double-free or use-after-free in fs/smb/client/smb2ops.c or smb2pdu.c on kernels with KASAN enabled
SMB client sessions repeatedly reconnecting or retrying QUERY_INFO operations against a single remote server

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against the fixed versions referenced in the upstream stable commits
Monitor kernel ring buffer output for slab corruption warnings, BUG: KASAN entries, and stack traces containing smb2_query_info or SMB2_query_info_init
Alert on unexpected mounts to untrusted SMB servers, especially from servers, workstations, or containers that should not initiate outbound SMB traffic

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and build detections for SMB client crash signatures
Track outbound TCP/445 and TCP/139 connections from Linux hosts and baseline expected SMB destinations
Enable audit rules for mount syscalls with -t cifs or -t smb3 filesystem types to detect ad-hoc mounts against unfamiliar servers

How to Mitigate CVE-2026-64386

Immediate Actions Required

Update the Linux kernel to a stable release containing the upstream fix commits referenced by kernel.org
Reboot affected systems after kernel package installation so the patched cifs.ko module is loaded
Restrict outbound SMB traffic from Linux servers and endpoints to a known allowlist of trusted file servers

Patch Information

The fix resets response bookkeeping before each retry attempt in query_info(), preventing the cleanup path from freeing a stale response buffer. The change was merged across the following stable branches: 100fb7c455fa, 2a88561d66eb, 3c81dda84799, 89234773e834, and f1add4acb656. Apply the vendor-supplied kernel package that corresponds to your distribution's stable series.

Workarounds

Unload the cifs kernel module on systems that do not require SMB client functionality using modprobe -r cifs
Blocklist the cifs module until patching is complete by adding install cifs /bin/true to /etc/modprobe.d/disable-cifs.conf
Block outbound TCP/445 at the host or network firewall to prevent Linux clients from reaching untrusted SMB servers

bash

# Configuration example
# Verify running kernel version
uname -r

# Disable the cifs module until the kernel is patched
echo 'install cifs /bin/true' | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo modprobe -r cifs

# Block outbound SMB at the host firewall (nftables example)
sudo nft add rule inet filter output tcp dport {139, 445} drop