CVE-2026-64384

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability occurs due to a double-free error when handling change notify replies. If a response attempt returns a replayable error and frees its buffer, and then SMB2_notify_init() fails, the same buffer can be freed again. This can lead to memory corruption and potentially a denial of service.

This vulnerability is rated as having Moderate severity for Red Hat Enterprise Linux because exploitation requires an established CIFS or SMB mount interacting with a malicious or faulty server under specific replay error conditions. Under standard deployments, systems that do not mount remote SMB shares or request directory change notifications are not exposed to this flaw. In the worst case, local denial of service through kernel crash or potential privilege escalation could occur if memory corruption is induced via a compromised remote file share.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.