In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability, a double-free error, occurs when the `query_info()` replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2 query before the next data send, leading to the same memory being freed twice. Such an issue can result in memory corruption, potentially causing a denial of service (DoS) condition for the system.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt Red Hat Hardened Images Not affected erlang27 https://www.cve.org/CVERecord?id=CVE-2026-64386 https://nvd.nist.gov/vuln/detail/CVE-2026-64386 https://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64386-9e73@gregkh/T