CVE-2026-64384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

Score

CVSS 3.1 9.8 Critical

Status

Modified - 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-07-25

Last modified

2026-10-19

Weaknesses

CWE-415

Affected products

• Linux Kernel (Linux)

References

• https://git.kernel.org/stable/c/5821f9dbb8b5b24391850a13418e633edd0fb003
• https://git.kernel.org/stable/c/d684f4134998085702009b94c35c2003fc9e72d3
• https://git.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68
• https://git.kernel.org/stable/c/901891513951bc8322ece754863909ea45af95c6
• https://git.kernel.org/stable/c/145f820dcbb2cced374f2532f8a61a44dce4a615