CVE-2026-64385

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A double-free vulnerability exists in the SMB2_ioctl() replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted responses during an I/O control (ioctl) replay sequence. This could lead to a remote denial of service due to a kernel crash, and potentially allow for privilege escalation.

A double-free flaw was found in the Linux kernel SMB (Server Message Block) client's SMB2_ioctl() replay path, which Red Hat rates as IMPORTANT. When an SMB2 ioctl attempt that received a response returns a replayable error, its response buffer is freed; if SMB2_ioctl_init() then fails before the next send attempt, the cleanup path retains the previous buffer type and frees that already-released response again. A malicious or compromised SMB server can exploit this by returning crafted responses during an ioctl replay sequence, causing a kernel crash (denial of service) and potentially privilege escalation on the client system.

The Red Hat Enterprise Linux kernel and kernel-rt packages in the RHEL 9.6.z, 9.8.z, 9.9, 10.0.z, 10.2.z, and 10.3 streams are affected, and fixes are being pursued for those streams. The Red Hat In-Vehicle OS 2.0 and 2.1 kernels (kernel, kernel-rt, and kernel-ivos-qualcomm) are also affected. RHEL 6, RHEL 7, and RHEL 8, as well as RHEL 9.2 and 9.4, are not affected because the vulnerable code is not present in those kernels.

Red Hat's severity of IMPORTANT (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) differs from the upstream CVE.org rating of CRITICAL (CVSS 9.8, AV:N/AC:L/PR:N) because exploitation requires a low-privileged local user to initiate an SMB connection to a malicious server and to reach a specific error-handling path during an ioctl replay, making the practical attack requirements more restrictive than the upstream assessment reflects.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw is triggered when the kernel SMB client processes crafted responses from a malicious or compromised SMB server. As a workaround, avoid mounting or accessing SMB/CIFS shares from untrusted servers, and disconnect existing mounts from servers that are not fully trusted. A complete fix requires updating to a kernel that contains the fix once it is available for the affected stream.