CVE-2026-64386

What it actually does

This is a Linux kernel SMB client memory-corruption flaw caused by stale response-buffer bookkeeping during SMB query_info replay handling. A response-bearing SMB operation can return a replayable error and free its response buffer; if initialization of the next SMB2 query_info send attempt fails, cleanup may free the same response buffer a second time. The result is a kernel double-free condition in the SMB/CIFS client path. Depending on allocator state, kernel hardening, and exploit reliability, impact can range from client kernel panic/denial of service to potential privilege escalation or kernel code execution. The most realistic attack surface is a Linux system that mounts or connects to a malicious or compromised SMB server/share.

Why it matters to the business

Successful exploitation can crash affected Linux systems that access SMB shares and may create a path to deeper compromise if the memory corruption is made reliable. This is most concerning for workstations, file-processing servers, backup systems, jump hosts, or automated services that mount SMB/CIFS shares, especially when they connect to third-party, user-supplied, or otherwise untrusted SMB servers. Although the CVSS score is critical, current provided exploitation maturity is none, EPSS is low, and it is not listed in CISA KEV, so remediation should be prioritized by exposure to SMB mounts rather than assumed active mass exploitation.

How an attack unfolds

An attacker would need to influence the SMB server side of a connection made by a vulnerable Linux SMB client. The attacker can do this by operating a malicious SMB server, compromising a legitimate SMB server, or luring a user or automated process into mounting or browsing an attacker-controlled SMB share. Once the Linux client issues SMB2 query_info requests, the malicious server returns responses that drive the replayable-error path. The vulnerable client frees the response buffer associated with one attempt, but stale bookkeeping remains. If the next SMB2_query_info_init() attempt fails before a new send, the cleanup path frees the previous response buffer again. This double-free corrupts kernel heap state and may immediately crash the host or, with sufficient heap shaping and bypasses, provide a primitive for more serious kernel compromise. There are no named threat actors or known exploitation campaigns provided for this vulnerability.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the SMB client query_info replay double-free. Because no affected package list or exact fixed versions were provided, use your Linux distribution vendor’s security advisory and kernel changelog to identify the first fixed kernel for your release stream. Prioritize systems that mount SMB/CIFS shares, use autofs with SMB, run backup or file-indexing jobs against SMB, or allow users to browse arbitrary network shares. If immediate patching is not possible, reduce exposure by disabling unnecessary SMB/CIFS client usage, preventing mounts of untrusted SMB shares, restricting outbound SMB traffic to approved file servers, disabling automount behavior where feasible, and isolating systems that must access third-party SMB servers. Reboot into the fixed kernel after installation; merely installing a kernel package is not sufficient if the vulnerable kernel remains running.

How to confirm the fix worked

Confirm that the running kernel, not just the installed kernel package, contains the vendor fix. Validate with uname -r, distribution package metadata, and vendor advisory references for the fixed kernel build. Inventory active SMB/CIFS usage by checking mounted filesystems and configuration files such as /proc/mounts, /etc/fstab, systemd mount units, and autofs maps. Confirm that outbound SMB access is limited to approved servers using firewall, proxy, or network telemetry. For high-assurance validation, review the kernel source or vendor changelog for the SMB client fix that resets response bookkeeping before each query_info attempt. After patching and rebooting, verify that no vulnerable kernel remains booted and that older kernels are not selected by default in the bootloader.

Typical attack path

1. Attacker sets up or compromises an SMB server reachable by a vulnerable Linux client.
2. Attacker convinces a user, script, service, or automount configuration to access or mount the attacker-controlled SMB share.
3. The Linux SMB client sends SMB2 query_info operations while interacting with files, directories, metadata, or share information.
4. The malicious server returns a response pattern that causes a replayable error after a response buffer has been allocated and freed.
5. A subsequent SMB2_query_info_init() path fails before the next send while stale response-buffer metadata remains.
6. Kernel cleanup frees the already-freed response buffer again, triggering memory corruption.
7. The affected system may crash, lose availability, or potentially allow further kernel-level exploitation if the double-free is weaponized reliably.

How to detect it

Look for evidence that Linux systems connected to suspicious or unapproved SMB servers before experiencing kernel instability. Relevant sources include kernel logs from journalctl -k, /var/log/kern.log, /var/log/messages, crash dumps, kdump/vmcore data, endpoint telemetry, mount history, shell history, systemd mount logs, autofs logs, and network flow records for outbound TCP/445. Investigate kernel panics, KASAN or slab allocator warnings, double-free reports, general protection faults, or BUG/Oops traces that mention CIFS, SMB2, smb3, query_info, or SMB2_query_info. Correlate crash timing with new SMB mounts, failed SMB reconnects, unusual SMB servers, or users browsing unfamiliar shares. Network telemetry should be reviewed for Linux clients initiating SMB sessions to external, newly observed, or non-approved internal hosts. Absence of these artifacts does not prove non-exploitation because successful memory corruption may leave limited logs, especially if the host panics before logs are flushed.

• KASAN: double-free
• double free
• BUG: KASAN
• kernel BUG
• general protection fault
• Oops:
• RIP: SMB2_query_info
• SMB2_query_info
• query_info
• CIFS:
• CIFS VFS:
• smb3
• mount.cifs
• /proc/fs/cifs/DebugData
• /sbin/mount.cifs
• /usr/sbin/mount.cifs
• tcp/445

What your security team should do

• Patch and reboot Linux systems that mount or access SMB/CIFS shares, prioritizing internet-adjacent workstations, file-transfer hosts, backup systems, and automation servers.
• Inventory Linux hosts using SMB/CIFS by collecting mounted filesystems, /etc/fstab entries, systemd mount units, autofs maps, and package usage of cifs-utils.
• Restrict outbound SMB traffic, especially TCP/445, so clients can only reach approved SMB servers.
• Block or alert on connections from Linux clients to unknown or user-supplied SMB servers.
• Temporarily disable automounting or browsing of untrusted SMB shares on systems that cannot be patched quickly.
• Monitor kernel logs for crashes, allocator warnings, KASAN reports, or CIFS/SMB client errors associated with SMB2 query_info activity.
• Preserve crash dumps, kernel logs, and network flow records from any affected host that panics while accessing SMB shares.
• Track distribution advisories for exact fixed kernel package versions because fixed versions were not provided in the input.