Skip to main content

Linux Kernel EUVDEUVD-2026-48927

| CVE-2026-64383 CRITICAL
Double Free (CWE-415)
2026-07-25 Linux GHSA-j3g4-c7cw-5ch7
Information Disclosure Linux
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.8 MEDIUM

Client must mount an attacker-controlled/MITM SMB server (AV:A, UI:R) and win a replay-retry race (AC:H); double-free realistically yields a kernel crash, so A:H with C/I:N.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 27, 2026 - 05:42 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
9.8 (CRITICAL)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double-free in SMB2_flush() replay

SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, flush_exit will free the stale response pointer a second time.

Reinitialize resp_buftype and rsp_iov at the top of the replay loop so cleanup only acts on response state produced by the current attempt. This fixes a double-free without changing replay handling for successful requests.

AnalysisAI

Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.

Technical ContextAI

The affected component is the in-kernel SMB/CIFS client (fs/smb/client), which implements SMB2/SMB3 protocol handling for mounting remote Windows/Samba shares. SMB2/3 supports request replay: when a channel or session is re-established (e.g., after a transient failure or with multichannel), the client may resend an idempotent operation such as FLUSH. The bug is CWE-415 (double free): SMB2_flush() carries its response-buffer bookkeeping (resp_buftype and rsp_iov) into the replay loop without reinitializing it per attempt. If a replayable response is received but the retry aborts before cifs_send_recv() overwrites the stored response pointer, the shared flush_exit cleanup path frees the same, now-stale, response pointer twice. The upstream fix reinitializes resp_buftype and rsp_iov at the top of the replay loop so cleanup only operates on state produced by the current attempt, without altering behavior for successful requests. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e., the kernel itself.

RemediationAI

Vendor-released patch: update to a fixed kernel - 6.6.145, 6.12.96, 6.18.39, or 7.1.4 (also fixed in 7.2-rc1) or later on the corresponding branch. Distribution users should apply the corresponding vendor kernel update: Ubuntu users see https://ubuntu.com/security/notices/USN-8726-1 and https://ubuntu.com/security/notices/USN-8727-1. Upstream stable commits are at https://git.kernel.org/stable/c/6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb and siblings (013a9a3d…, 87875716…, 3407240c…, 4be31c94…). Where immediate patching is not possible, the practical compensating control is to only mount SMB/CIFS shares from trusted servers and avoid mounting from untrusted or internet-reachable endpoints, since the trigger requires a malicious or MITM server response; enforcing SMB signing and encryption (seal) and restricting outbound 445/tcp to known file servers reduces the MITM avenue, at the cost of blocking ad-hoc SMB connectivity. There is no application-level workaround within the client short of not using the affected mount path.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-48927 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy