CVE-2026-64386

CriticalCVSS 9.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix query_info() replay double-free

A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

VendorProductVersions
LinuxLinux>= 433042a91f9373241307725b52de573933ffedbf, < 100fb7c455fa86d248b8bd7bb9de757c192870b4; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < 3c81dda84799f76b42aec598564316e2964440db; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < f1add4acb656f5a82806a1ab0e63fed3d8b1bfca; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < 89234773e8348918111aa15f6922b58cf3843364; >= 4f1fffa2376922f3d1d506e49c0fd445b023a28e, < 2a88561d66eb855813cf004a0abe648bbb17de5e; >= 6.6.32, < 6.6.145
LinuxLinux6.8

References

Timeline

Published
Jul 25, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-643879.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearingCVE-2026-643887.8In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chowCVE-2026-643898.2In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_authCVE-2026-64394.4The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insuffiCVE-2026-643908.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds eaCVE-2026-643919.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are sCVE-2026-643929.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can CVE-2026-643939.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers calCVE-2026-643948.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY comCVE-2026-643957.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATCVE-2026-643968.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellatCVE-2026-643979.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() st
CVE-2026-64386: Critical severity, CVSS 9.8 | Vulnix