CVE-2026-64384

What it actually does

This is a Linux kernel SMB client memory-corruption flaw caused by stale response-buffer bookkeeping during SMB change-notify retry handling. A replayable error can cause the SMB client to free a response buffer, and if the next SMB2_notify_init() attempt fails before a new send occurs, cleanup can free the same buffer again. That double-free can corrupt kernel heap state, leading to kernel panic, denial of service, or potentially arbitrary code execution in kernel context depending on allocator behavior, kernel hardening, and exploit reliability.

Why it matters to the business

Systems that use the Linux kernel SMB/CIFS client to connect to SMB file shares could be crashed or potentially compromised by a malicious or compromised SMB server, or by an attacker able to interfere with SMB traffic. The operational impact can include unexpected reboots, loss of access to network file shares, workload disruption, and in the worst case full host compromise. Although this issue is not currently listed in CISA KEV and has low EPSS at this time, the CVSS severity is critical and the bug is in kernel code, so organizations with Linux systems mounting SMB shares should prioritize remediation and exposure reduction.

How an attack unfolds

An attacker needs a target Linux system to use the vulnerable SMB/CIFS client against an attacker-controlled, compromised, or intercepted SMB service. The attacker crafts SMB change-notify behavior so that a response-bearing attempt returns a replayable error and causes the client to free its response buffer. The attacker then causes the following SMB2_notify_init() path to fail before the next send, leaving stale bookkeeping that results in cleanup freeing the same buffer again. This double-free corrupts kernel memory. A simple exploitation outcome is a kernel crash and denial of service; a more advanced attacker may attempt to shape heap state and bypass kernel mitigations to gain code execution with kernel privileges.

How to fix it

Apply the Linux kernel update from the relevant distribution or kernel vendor that includes the SMB client fix for the change-notify replay double-free. Because no exact fixed package versions were provided, use vendor advisories and package changelogs to identify the first kernel build containing the fix, then reboot into the updated kernel or apply an equivalent live patch if supported. As compensating controls, unmount unnecessary CIFS/SMB shares, disable automated mounts to untrusted SMB servers, restrict outbound SMB traffic on TCP/445 to approved file servers, avoid connecting Linux hosts to untrusted SMB shares, and monitor or block SMB traffic that crosses untrusted network boundaries. Where feasible, require SMB signing/encryption to reduce interception risk, while recognizing this does not protect clients from a malicious or compromised SMB server.

How to confirm the fix worked

Confirm the running kernel, not only the installed package, has been updated by checking uname -r and comparing it with the vendor-fixed kernel version or advisory. Verify package changelogs or source patches include the SMB client change that resets response bookkeeping before each notify attempt. Reboot systems after kernel installation unless a validated live patch is active. Confirm CIFS/SMB mounts are still functional after patching, and review /proc/mounts, systemd mount units, autofs maps, and fstab entries to identify remaining SMB exposure. For mitigation validation, test that outbound TCP/445 is only permitted to approved SMB servers and that unnecessary CIFS mounts are absent.

Typical attack path

1. Identify Linux systems that mount or access SMB/CIFS shares using the kernel SMB client.
2. Position as a malicious SMB server, compromise a legitimate SMB server, or intercept/modify SMB traffic where protections allow.
3. Trigger SMB change-notify operations from the client, commonly by having the client monitor directories or file changes on the share.
4. Return a response-bearing replayable error that causes the client to free the response buffer.
5. Cause the subsequent SMB2_notify_init() attempt to fail before the next send so cleanup reuses stale response-buffer state.
6. Trigger the double-free condition in kernel memory.
7. Leverage the resulting memory corruption to crash the system or attempt kernel-level code execution.

How to detect it

Review kernel and system logs for signs of SMB client-triggered memory corruption, especially shortly after connections to SMB shares or directory change-notify activity. Primary sources include dmesg, journald kernel facility logs, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dumps, kdump/vmcore artifacts, KASAN reports, and EDR telemetry that records kernel panics or process-triggered mounts. Correlate crashes with outbound SMB connections to TCP/445, mount.cifs executions, systemd mount activity, autofs triggers, or access to unusual SMB servers. Look for repeated kernel oopses, slab allocator corruption, double-free reports, CIFS/SMB client errors, and call traces containing SMB2_notify_init or CIFS/SMB client functions. Because there are no universal network indicators for this vulnerability, detection should focus on host crash artifacts and SMB traffic to unexpected servers. If exploitation is suspected, preserve crash dumps, kernel logs, SMB server details, recent mount activity, and network flow records before rebooting or reimaging.

• BUG: KASAN: double-free
• KASAN: double-free
• double free
• kernel BUG at mm/slub.c
• general protection fault
• slab corruption
• corrupted double-linked list
• CIFS: VFS:
• SMB2_notify_init
• cifs_demultiplex_thread
• mount.cifs
• kernel panic - not syncing
• Oops:
• TCP/445

What your security team should do

• Inventory Linux systems that mount SMB/CIFS shares, including fstab entries, systemd mount units, autofs maps, containers with host mounts, and backup or file-processing workloads.
• Prioritize patching internet-adjacent, workstation, VDI, jump host, file-processing, and production Linux systems that connect to SMB shares.
• Restrict outbound SMB on TCP/445 to trusted file servers and block access to unknown or user-supplied SMB destinations.
• Treat compromised or untrusted SMB servers as possible client-exploitation infrastructure and isolate them from Linux clients until investigated.
• Enable collection of kernel logs, journald, audit logs, and network flow logs for SMB client systems to support exploitation review.
• Search historical logs for kernel double-free, KASAN, slab corruption, CIFS, and SMB2 notify-related crashes around SMB activity.
• Where patching is delayed, unmount nonessential SMB shares and disable automount paths that can be triggered by users or remote workflows.
• Track vendor advisories for exact fixed kernel versions and confirm systems are booted into the remediated kernel.