CVE-2026-64597

Full vulnerability record from the local CVENow database.
Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
Severity
CRITICAL
CVSS score
9.8 (v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-06 08:16:35.340000
Last modified
2026-10-19 21:17:48.963000
View original CVE JSON
{
  "id": "CVE-2026-64597",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-06T08:16:35.340",
  "lastModified": "2026-10-19T21:17:48.963",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "lessThan": "037511726228aaf165c7067ff2bfc88eaecdf1f3",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "lessThan": "0aa97edf7c347c0f54e7e60c4740574b8120c66a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "lessThan": "d15d83125007f673aec4323e1bbbaaffbe87ea13",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "lessThan": "b18ed621dbfceecea5539848cddcb9272c9a61e1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "lessThan": "f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.6.32",
              "lessThan": "6.6.145",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.8",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.145",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.96",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.39",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.4",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:43:23.981933Z",
          "id": "CVE-2026-64597",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}