CVE-2026-64386
A critical vulnerability in the Linux kernel’s SMB client caused a double-free error when handling certain query responses. The issue was fixed by resetting response bookkeeping before each attempt, preventing the stale free. Users should update their kernel to a version that includes this patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, particularly those running SMB client functionality. The exact kernel versions affected are not listed, but any kernel containing the vulnerable SMB client code is potentially impacted.
Real-world impact
An attacker could exploit the double-free to crash the SMB client or potentially execute arbitrary code, leading to denial of service or privilege escalation on the affected system.
Why this severity
The CVSS score of 9.8 reflects a high impact (confidentiality, integrity, availability) with no authentication or user interaction required, making it a critical threat.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2026-64386.
NVD-referenced vendor advisory
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.