CVE-2026-64385
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A double-free vulnerability exists in the SMB2_ioctl() replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted responses during an I/O control (ioctl) replay sequence. This could lead to a remote denial of service due to a kernel crash, and potentially allow for privilege escalation.
Statement
A double-free flaw was found in the Linux kernel SMB (Server Message Block) client's SMB2_ioctl() replay path, which Red Hat rates as IMPORTANT. When an SMB2 ioctl attempt that received a response returns a replayable error, its response buffer is freed; if SMB2_ioctl_init() then fails before the next send attempt, the cleanup path retains the previous buffer type and frees that already-released response again. A malicious or compromised SMB server can exploit this by returning crafted responses during an ioctl replay sequence, causing a kernel crash (denial of service) and potentially privilege escalation on the client system.
The Red Hat Enterprise Linux kernel and kernel-rt packages in the RHEL 9.6.z, 9.8.z, 9.9, 10.0.z, 10.2.z, and 10.3 streams are affected, and fixes are being pursued for those streams. The Red Hat In-Vehicle OS 2.0 and 2.1 kernels (kernel, kernel-rt, and kernel-ivos-qualcomm) are also affected. RHEL 6, RHEL 7, and RHEL 8, as well as RHEL 9.2 and 9.4, are not affected because the vulnerable code is not present in those kernels.
Red Hat's severity of IMPORTANT (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) differs from the upstream CVE.org rating of CRITICAL (CVSS 9.8, AV:N/AC:L/PR:N) because exploitation requires a low-privileged local user to initiate an SMB connection to a malicious server and to reach a specific error-handling path during an ioctl replay, making the practical attack requirements more restrictive than the upstream assessment reflects.
Mitigation
This flaw is triggered when the kernel SMB client processes crafted responses from a malicious or compromised SMB server. As a workaround, avoid mounting or accessing SMB/CIFS shares from untrusted servers, and disconnect existing mounts from servers that are not fully trusted. A complete fix requires updating to a kernel that contains the fix once it is available for the affected stream.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
