CVE-2026-64597 Overview
CVE-2026-64597 is a double-free vulnerability in the Linux kernel's SMB client code, specifically in the SMB2_close() replay path. The flaw exists in the smb: client subsystem that handles SMB2/3 protocol operations against remote file servers. When a response-bearing attempt returns a replayable error, the client frees its response buffer but retains the previous buffer type in its bookkeeping state. If SMB2_close_init() subsequently fails before the next send, the cleanup routine frees the already-released response buffer a second time.
Critical Impact
A double-free in kernel memory management can lead to memory corruption, kernel panic, or potential privilege escalation on systems mounting SMB shares that trigger replayable errors.
Affected Products
- Linux kernel (upstream) — SMB client (fs/smb/client)
- Distributions shipping affected stable kernel branches referenced in the upstream commits
- Any system mounting remote SMB2/SMB3 shares using the in-kernel cifs/smb client
Discovery Timeline
- 2026-08-06 - CVE-2026-64597 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64597
Vulnerability Analysis
The vulnerability resides in the SMB2 close operation replay logic within the Linux kernel SMB client. SMB2_close() is invoked to close file handles on a remote SMB server. When the initial send attempt receives a response but returns a replayable error code, the client releases the response buffer and prepares to retry the operation. The retry path calls SMB2_close_init() to reinitialize request state before sending again.
The defect lies in how buffer bookkeeping state is carried between attempts. The response buffer type is not reset before the next iteration. When SMB2_close_init() fails prior to issuing a new send, the error cleanup path inspects the stale buffer type and invokes free on the response buffer that was already released during the previous attempt. This produces a double-free on the SMB response allocation.
Root Cause
The root cause is stale response bookkeeping across replay iterations. The response buffer pointer and its associated type indicator are not cleared after the first free, so the subsequent failure path uses out-of-date state to determine what memory to release. The upstream fix resets the response bookkeeping fields at the start of each attempt so that no cleanup path can reference a previously freed allocation.
Attack Vector
Triggering the flaw requires the SMB client to encounter a replayable error on a SMB2_close request followed by a failure in SMB2_close_init() before the retry send completes. This can occur when a client is connected to an SMB server that returns specific error responses under session or connection state conditions that force replay. A malicious or compromised SMB server on the network path could steer the client into the vulnerable code path. The vulnerability is a double-free defect [CWE-415] and code examples are not published; see the upstream commits for the exact patch diff.
Detection Methods for CVE-2026-64597
Indicators of Compromise
- Kernel log entries showing SLUB/SLAB double-free warnings, kernel BUG, or KASAN double-free reports originating from fs/smb/client or smb2pdu.c call stacks.
- Unexpected kernel oops or panic messages referencing SMB2_close, smb2_close_init, or cifs_buf_release around the time SMB shares are in use.
- Repeated SMB session disconnects or replay retries observed in dmesg when connected to a specific remote server.
Detection Strategies
- Enable kernel address sanitizer (KASAN) or SLUB debug (slub_debug=FZP) on test systems to surface double-free events during SMB workloads.
- Compare running kernel versions against the fixed commits (0375117, 0aa97ed, b18ed62, d15d831, f96e1cd) referenced on git.kernel.org to identify unpatched hosts.
- Correlate SMB client crash telemetry with network activity to specific SMB servers that generate replayable errors.
Monitoring Recommendations
- Forward kernel dmesg, journald, and crash-dump data to a centralized log platform and alert on double-free, use-after-free, and SMB client panics.
- Track SMB mount and error metrics from endpoints and servers that regularly access CIFS/SMB shares.
- Monitor kernel package inventory across the Linux estate to confirm distribution security updates have been applied.
How to Mitigate CVE-2026-64597
Immediate Actions Required
- Apply the vendor kernel update from your Linux distribution that includes the upstream SMB client fix once it is released for your kernel series.
- Restrict outbound SMB connectivity from Linux hosts to trusted file servers only, reducing exposure to hostile servers that could induce replay conditions.
- Audit systems that mount CIFS/SMB shares and prioritize patching servers, VDI hosts, and workstations that interact with untrusted networks.
Patch Information
The fix resets response bookkeeping before each SMB2 close attempt so that cleanup after a failed SMB2_close_init() cannot free a stale response buffer. The change is available across multiple stable branches through the following commits: 037511726228, 0aa97edf7c34, b18ed621dbfc, d15d83125007, and f96e1cdcb63e.
Workarounds
- Unmount SMB shares (umount -t cifs -a) on affected hosts until a patched kernel is deployed where feasible.
- Block outbound TCP/445 to untrusted destinations at host or perimeter firewalls to limit exposure to malicious SMB servers.
- Prefer alternative file-sharing protocols such as NFSv4 with Kerberos on hosts that cannot be patched quickly, if operational requirements allow.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
