Skip to main content

Linux Kernel EUVDEUVD-2026-48928

| CVE-2026-64384 CRITICAL
Double Free (CWE-415)
2026-07-25 Linux GHSA-hwgg-8wxq-m5c5
Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Client-side bug reachable only via a malicious/MITM SMB server (AV:A) and a timing race (AC:H); a kernel double-free yields DoS (A:H) with no confidentiality/integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Jul 27, 2026 - 05:42 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
9.8 (CRITICAL)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix change notify replay double-free

A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

AnalysisAI

Denial-of-service (kernel memory corruption) in the Linux kernel's cifs/smb client affects the SMB2 CHANGE_NOTIFY replay path. When a response-bearing notify attempt returns a replayable error and frees its response buffer, stale resp_buftype/rsp_iov bookkeeping is retained across attempts; if SMB2_notify_init() then fails before the next send, cleanup frees the already-freed response a second time (CWE-415 double-free). Exploitation requires a malicious or man-in-the-middle SMB server and winning a replay/retry-failure race, so real-world risk is DoS-leaning; no public exploit is identified and EPSS is low at 0.21%.

Technical ContextAI

The affected component is fs/smb/client (cifs), the Linux in-kernel SMB2/SMB3 network filesystem client, specifically its CHANGE_NOTIFY (directory-change watch) request path with SMB replay support. Replay is used when an operation must be retried transparently (e.g. after a transient/replayable server error). The root cause is CWE-415 (double free): the per-request response bookkeeping (resp_buftype and the rsp_iov iov array) is not reinitialized at the top of each replay iteration. A first attempt receives and frees its response, but the stale buffer type/pointer survives into the next iteration; when SMB2_notify_init() fails before cifs_send_recv() can store a replacement response, the notify_exit cleanup frees the already-freed buffer again. This is the same defect class as the SMB2_flush replay double-free (CVE-2026-64383); the fix resets response bookkeeping before each attempt. The CPE identifies the affected product as cpe:2.3:a:linux:linux, i.e. the Linux kernel itself.

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 (or later) on the appropriate stable series. Distribution users should apply the corresponding vendor kernel updates - Ubuntu USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1) - and reboot. The upstream fix commits are available at git.kernel.org (e.g. https://git.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68 and siblings 5821f9dbb8b5, d684f4134998, 901891513951, 145f820dcbb2). Where patching must be deferred, reduce exposure by only mounting SMB shares from trusted servers, enforcing SMB signing/encryption to defeat MITM tampering, and restricting outbound SMB (TCP 445) to known file servers so a rogue or interposed server cannot drive the client into the vulnerable replay path; the trade-off is that signing/encryption add CPU overhead and locking down server destinations may break ad-hoc share access.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-48928 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy