CVE-2026-64387

What it actually does

This is a Linux kernel SMB client memory-corruption flaw involving a double-free during SMB directory query retry/replay handling. A response-bearing SMB operation can return a replayable error and free its response buffer; if the next query-directory initialization fails before a new send occurs, stale response bookkeeping can cause the same buffer to be freed again. In kernel context, a double-free can lead to kernel memory corruption, system crash, or, depending on allocator state and exploit reliability, possible code execution with kernel privileges. The CVSS vector indicates remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact, although no public exploit maturity or KEV listing is currently reported.

Why it matters to the business

Systems using the Linux SMB/CIFS client to access SMB shares could be crashed or potentially compromised by a malicious or compromised SMB server. Operationally, this can interrupt file access, disrupt workloads relying on mounted SMB shares, and create a high-severity kernel compromise risk on affected endpoints, servers, appliances, or embedded Linux systems. Although EPSS is currently low and it is not listed in CISA KEV, the kernel-level impact and network attack surface warrant prompt remediation, especially where Linux systems automatically mount SMB shares or connect to untrusted file servers.

How an attack unfolds

An attacker positions or controls an SMB server that a vulnerable Linux system connects to, or compromises an SMB server already trusted by Linux clients. When the client performs a directory query, the malicious server returns a crafted sequence that produces a replayable error while causing the response buffer to be freed. The attacker then influences the next retry path so that query-directory initialization fails before another send resets the response state. Because stale response bookkeeping is retained, cleanup frees the prior response buffer a second time. This can corrupt kernel heap state, commonly causing a kernel oops or panic, and in more advanced exploitation scenarios may be shaped into arbitrary kernel memory corruption or privilege-level code execution.

How to fix it

Update affected Linux kernels to a version that includes the upstream SMB client fix for the query-directory replay double-free. If vendor packages are used, apply the latest security kernel update from the operating system or appliance vendor and reboot into the fixed kernel. Because no exact fixed package versions were provided, verify the vendor advisory or kernel changelog for the fix described as resetting SMB client response bookkeeping before each replay attempt or fixing the SMB client query-directory replay double-free. As temporary mitigation, restrict Linux systems from connecting to untrusted SMB servers, disable unnecessary SMB/CIFS mounts, remove or disable automount rules for SMB shares where possible, and use network controls to limit outbound SMB traffic to approved file servers only.

How to confirm the fix worked

Confirm exposure by identifying Linux systems with the CIFS/SMB client module in use, active CIFS mounts, automount configurations, or workloads that access smb:// or cifs-mounted paths. Validate remediation by confirming the running kernel version is the vendor-fixed version, not merely that the package is installed; a reboot is usually required. Check that the relevant SMB client patch is present in the kernel source/package changelog if version mapping is unclear. After patching, verify that CIFS mounts still function and monitor for absence of new kernel oops, panic, KASAN, slab, or CIFS-related errors during SMB directory listing operations. Network validation should confirm that outbound SMB connections are restricted to authorized destinations.

Typical attack path

1. Identify Linux systems that mount or access SMB/CIFS shares using the kernel SMB client.
2. Gain control of an SMB server, create a malicious SMB service, or lure/redirect a vulnerable client to connect to attacker-controlled SMB infrastructure.
3. Trigger directory enumeration or file listing activity from the client against the SMB share.
4. Return SMB responses that cause a replayable error and free the response buffer during the first attempt.
5. Cause the next query-directory initialization path to fail before a fresh send resets response bookkeeping.
6. Abuse the resulting stale cleanup path to free the same response buffer again, causing kernel memory corruption.
7. Leverage the memory corruption for denial of service or attempt further exploitation for kernel-level compromise.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, system journals, crash dumps, endpoint telemetry, and network flow records from Linux systems that use SMB/CIFS mounts. Focus on the time around SMB directory listing, mount, reconnect, or automount activity. Look for kernel oops, panic, slab allocator corruption, KASAN double-free reports, general protection faults, or stack traces referencing the CIFS/SMB2 client query directory path. Correlate these events with outbound SMB connections to unfamiliar servers, recently changed mount targets, suspicious DNS names, or unexpected TCP/445 traffic. Review /proc/mounts, fstab, systemd mount units, autofs maps, desktop file-manager activity, and application logs that may initiate SMB access. Because exploitation may only leave evidence as a crash or memory-corruption event, absence of logs does not prove absence of exploitation if the system rebooted or logs were not persisted.

• KASAN: double-free
• double free
• BUG: kernel NULL pointer dereference
• general protection fault
• kernel BUG at
• Oops:
• Kernel panic - not syncing
• slab corruption
• kmem_cache_free
• cifs.ko
• CIFS: VFS:
• SMB2_query_directory
• smb2_query_dir
• query_directory
• mount.cifs
• /sbin/mount.cifs
• type cifs
• tcp/445
• dport=445

What your security team should do

• Prioritize patching Linux systems that mount SMB/CIFS shares, especially servers, VDI hosts, backup systems, build systems, appliances, and endpoints with automatic SMB mounts.
• Reboot systems after kernel updates and verify the running kernel is the fixed version.
• Inventory active CIFS mounts using system configuration, endpoint telemetry, and network flow data for outbound TCP/445 connections.
• Restrict outbound SMB traffic to known, trusted SMB servers; block internet-bound SMB at network egress points.
• Disable unnecessary SMB/CIFS mounts and automount rules until patching is complete.
• Increase monitoring for kernel crashes, CIFS client errors, and SMB connections to unusual servers for systems not yet patched.
• Treat crashes following SMB directory browsing or mount activity as potentially suspicious until kernel logs and SMB connection history are reviewed.
• Track vendor advisories for exact fixed kernel/package versions because fixed versions were not provided in the input data.