In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix change notify replay double-free

A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_notify_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00457.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
433042a91f9373241307725b52de573933ffedbf affected < 5821f9dbb8b5b24391850a13418e633edd0fb003
4f1fffa2376922f3d1d506e49c0fd445b023a28e affected < d684f4134998085702009b94c35c2003fc9e72d3
4f1fffa2376922f3d1d506e49c0fd445b023a28e affected < 52af1975f0dfae990c5a0e85872cc41be0e88a68
4f1fffa2376922f3d1d506e49c0fd445b023a28e affected < 901891513951bc8322ece754863909ea45af95c6
4f1fffa2376922f3d1d506e49c0fd445b023a28e affected < 145f820dcbb2cced374f2532f8a61a44dce4a615
6.6.32 affected < 6.6.145
Linux Linux affected
Version Status Constraints
6.8 affected —
0 unaffected < 6.8
6.6.145 unaffected ≤ 6.6.*
6.12.96 unaffected ≤ 6.12.*
6.18.39 unaffected ≤ 6.18.*
7.1.4 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/145f820dcbb2cced374f2532f8a61a44dce4a615 cve-icon
https://git.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68 cve-icon
https://git.kernel.org/stable/c/5821f9dbb8b5b24391850a13418e633edd0fb003 cve-icon
https://git.kernel.org/stable/c/901891513951bc8322ece754863909ea45af95c6 cve-icon
https://git.kernel.org/stable/c/d684f4134998085702009b94c35c2003fc9e72d3 cve-icon
History

Mon, 27 Jul 2026 06:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 27 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.
Title smb: client: fix change notify replay double-free
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-27T05:00:12.445Z

Reserved: 2026-07-19T15:36:31.784Z

Link: CVE-2026-64384

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-27T05:45:02Z

Weaknesses