9.8

CVE-2026-64387

smb: client: fix query directory replay double-free

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix query directory replay double-free

A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_directory_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.6.32 < 6.6.145
Linux ≫ Linux Kernel Version >= 6.8.1 < 6.12.96
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.39
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.4
Linux ≫ Linux Kernel Version 6.8 Update -
Linux ≫ Linux Kernel Version 6.8 Update rc2
Linux ≫ Linux Kernel Version 6.8 Update rc3
Linux ≫ Linux Kernel Version 6.8 Update rc4
Linux ≫ Linux Kernel Version 6.8 Update rc5
Linux ≫ Linux Kernel Version 6.8 Update rc6
Linux ≫ Linux Kernel Version 6.8 Update rc7
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.372
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98
Patch
https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994
Patch
https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336
Patch
https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde
Patch
https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7
Patch