CVE-2026-64385 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers using the Linux kernel should assess their exposure and apply the fix if necessary. This includes reviewing system logs for potential exploitation attempts, verifying the presence of the fix in Linux distributions, and applying the fix to prevent potential double-free issues. Additionally, operators and platform managers should be aware of the vulnerability and its potential impact on their Linux-

Why it matters

The Linux kernel's SMB2_ioctl() replay functionality has a double-free vulnerability that can be exploited if not properly fixed. Linux system administrators and security teams should prioritize verifying the presence of the fix and applying it if necessary.

• Verify the presence of the fix in Linux distributions to prevent potential double-free issues
• Apply the fix to prevent potential exploitation attempts
• Monitor Linux system logs for potential exploitation attempts

Technical summary

The Linux kernel's SMB2_ioctl() replay functionality is vulnerable to a double-free issue. A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. The issue is addressed by resetting response bookkeeping before each attempt to prevent the stale free. This vulnerability can be exploited if not properly fixed, potentially leading to denial-of-service or code-execution attacks. Linux system administrators and security teams should prioritize verifying the presence of the fix in their Linux distributions and applying it if necessary.

Defensive priority

Linux system administrators and security teams should prioritize verifying the presence of the fix in their Linux distributions and applying it if necessary.

Recommended defensive actions

• Verify the presence of the fix in your Linux distribution
• Apply the fix if necessary
• Monitor Linux system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. Linux kernel developers have addressed the issue through commits 0be4bc64882edaefaaee8d1e27d083643eb778e6, 96fcfc8ae7359346156e492ca610e830d2649ad6, 276c8efbc49f9303ac76d0d4deab7128581b0f3b, fc65ffb4ef1bf540da16b17c225ae51091e07d72, and f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.