CVE-2026-64386

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability, a double-free error, occurs when the query_info() replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2 query before the next data send, leading to the same memory being freed twice. Such an issue can result in memory corruption, potentially causing a denial of service (DoS) condition for the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the cifs kernel module from being loaded if SMB/CIFS network file systems are not required.

1. Add the module to the modprobe blacklist configuration:

echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf

echo "blacklist cifs" >> /etc/modprobe.d/disable-cifs.conf

2. If the module is currently loaded, unmount all active CIFS shares and unload the module:

modprobe -r cifs

Caveats: Disabling the module prevents the system from mounting or accessing remote SMB/CIFS file shares. If the module cannot be unloaded immediately due to active usage, a system restart will be required for the configuration to take effect.