CVE-2026-64387: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64387 Overview

CVE-2026-64387 is a double-free vulnerability in the Linux kernel's SMB client code, specifically in the query directory replay path. A response-bearing attempt can return a replayable error and free its response buffer. When SMB2_query_directory_init() fails before the next send, the cleanup routine retains the previous buffer type and frees that response a second time. The fix resets response bookkeeping before each attempt to prevent the stale free.

Critical Impact
The double-free condition in the SMB client corrupts kernel heap state and can lead to memory corruption, kernel panic, or potential privilege escalation on systems that mount SMB shares.

Affected Products

Linux kernel SMB client (fs/smb/client)
Distributions shipping affected stable kernel branches prior to the patch commits
Systems mounting remote shares over SMB2/SMB3

Discovery Timeline

2026-07-25 - CVE-2026-64387 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64387

Vulnerability Analysis

The flaw resides in the SMB2 query directory replay logic within the Linux kernel's CIFS/SMB client. When the client issues an SMB2 QUERY_DIRECTORY request, the response buffer is tracked using a per-request buffer type. If the initial attempt returns a replayable error, the response buffer is released as part of error handling, but the buffer type metadata remains unchanged.

On the subsequent replay attempt, SMB2_query_directory_init() may fail before the request is sent again. The cleanup path then inspects the stale buffer-type field and frees the already-released response buffer a second time. This double-free corrupts the kernel's slab allocator state.

A network-adjacent attacker who controls or interferes with an SMB server response can trigger the replayable error path repeatedly. Successful exploitation causes memory corruption in kernel context, which may enable denial of service or, with additional heap grooming, escalation to arbitrary kernel code execution.

Root Cause

The root cause is missing state reset between retry attempts in the SMB2 query directory replay flow. The response bookkeeping fields, including buffer type identifiers, persist across attempts. When the second SMB2_query_directory_init() call fails early, the generic cleanup routine treats stale metadata as valid and dereferences pointers that were already freed. This is a classic double-free condition [CWE-415].

Attack Vector

Exploitation requires the target Linux system to establish an SMB session with an attacker-influenced server or through a man-in-the-middle position on the network. The attacker forces conditions that produce a replayable SMB error, then induces a follow-up initialization failure. No user interaction or authentication on the target host is required beyond the existing SMB mount context.

The vulnerability is described in the upstream kernel commit 1665f25b1dea30bf2d02e16245d203a944c9d994 and companion stable backports. Refer to the Linux Kernel Commit 1665f25 for the source-level fix.

Detection Methods for CVE-2026-64387

Indicators of Compromise

Kernel oops or panic messages referencing SMB2_query_directory, smb2_query_directory, or slab allocator corruption after SMB retries.
dmesg entries showing KASAN: double-free or BUG: KFENCE warnings tied to CIFS/SMB code paths.
Repeated SMB2 replay attempts from a single mount followed by client-side crashes or hung file system operations.

Detection Strategies

Monitor kernel logs for CIFS client errors correlated with SMB session drops or server-side error injection.
Inspect running kernel versions on hosts that mount SMB shares and compare against the patched stable release tags.
Enable KASAN or KFENCE in test kernels to surface the double-free during quality assurance runs.

Monitoring Recommendations

Alert on unexpected cifs module crashes reported by the kernel logging subsystem.
Track SMB client mounts to identify hosts that communicate with untrusted or Internet-reachable SMB servers.
Baseline normal SMB error rates and flag sustained bursts of replayable error responses from a single peer.

How to Mitigate CVE-2026-64387

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix commits listed in the vendor references.
Restrict SMB client connections to trusted servers only, preferably over authenticated and signed sessions.
Reboot affected hosts after patching to ensure the vulnerable kernel image is no longer resident.

Patch Information

The fix resets SMB response bookkeeping before each retry attempt, preventing the cleanup path from acting on stale buffer-type metadata. The change is present in the following upstream commits:

Consult your Linux distribution's security tracker for backported package versions.

Workarounds

Unmount SMB shares on hosts that cannot be patched immediately and disable automatic cifs mounts.
Block outbound SMB traffic (TCP/445) to untrusted networks at the perimeter firewall.
Require SMB signing and encryption to reduce the risk of a malicious server injecting replayable error conditions.

bash

# Verify running kernel and blocklist the cifs module where SMB is not needed
uname -r
sudo umount -a -t cifs
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo depmod -a