CVE-2026-64383

CriticalCVSS 9.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double-free in SMB2_flush() replay

SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, flush_exit will free the stale response pointer a second time.

Reinitialize resp_buftype and rsp_iov at the top of the replay loop so cleanup only acts on response state produced by the current attempt. This fixes a double-free without changing replay handling for successful requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-643849.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing aCVE-2026-643859.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearingCVE-2026-643869.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing atCVE-2026-643879.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearingCVE-2026-643887.8In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chowCVE-2026-643898.2In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_authCVE-2026-64394.4The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insuffiCVE-2026-643908.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds eaCVE-2026-643919.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are sCVE-2026-643929.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can CVE-2026-643939.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers calCVE-2026-643948.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY com
CVE-2026-64383: Critical severity, CVSS 9.8 | Vulnix