CVE-2026-64384 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize SMB client functionality should assess exposure and verify remediation status.

Why it matters

The Linux kernel's SMB client implementation is vulnerable to a double-free attack, which can lead to denial-of-service or potentially code execution. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize SMB client functionality should assess exposure and verify remediation status.

• Denial-of-service attacks may be supported.
• Code execution may be supported.
• Remediation priority requires verification from official sources.
• Exposure requires verification from official sources.

Technical summary

The Linux kernel's SMB client implementation is vulnerable to a double-free attack. When a response-bearing attempt returns a replayable error and frees its response buffer, and SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. This can lead to a denial-of-service or potentially code execution. The vulnerability affects Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize SMB client functionality. The CVE record and source item provide details about the vulnerability, including its description and affected versions.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor system logs for potential denial-of-service or code execution attempts.
• Perform a thorough review of system configurations and ensure that all necessary security measures are in place.
• Verify that all necessary patches are applied and that the system is up-to-date.
• Check for any potential vulnerabilities in the system and address them promptly.
• Implement additional security measures to prevent similar attacks in the future.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish exploitation or impact, and remediation priority requires verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.