CVE-2026-64382

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double-free in SMB2_open() replay

A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

VendorProductVersions
LinuxLinux>= 433042a91f9373241307725b52de573933ffedbf, < 02bc2896bdc3e29362d6e40d404006944a159c25; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < 3196b5192f246df4272072f61a2f4a3e9967f55d; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < 14498ff5ce0f272ce0ef988721413e06b7038972; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < ff2d30927bc3bf3c629f0768d2068096e64ef5ce; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < b55e182f2324bc6a604c21a47aa6c448f719a532; >= 6.6.32, < 6.6.145
LinuxLinux6.8

References

Timeline

Published
Jul 25, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-643839.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keepsCVE-2026-643849.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing aCVE-2026-643859.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearingCVE-2026-643869.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing atCVE-2026-643879.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearingCVE-2026-643887.8In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chowCVE-2026-643898.2In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_authCVE-2026-64394.4The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insuffiCVE-2026-643908.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds eaCVE-2026-643919.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are sCVE-2026-643929.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can CVE-2026-643939.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers cal
CVE-2026-64382: High severity, CVSS 8.8 | Vulnix