CVE-2026-64597: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64597 is a double-free vulnerability in the Linux kernel's SMB client code, specifically within the SMB2_close() function during replay attempts. When a response-bearing attempt returns a replayable error and frees its response buffer, subsequent cleanup can incorrectly free the same buffer again if SMB2_close_init() fails before the next send — because response bookkeeping is not reset between attempts. Affected kernel versions include the 6.6.x stable series from 6.6.32 up to (but not including) 6.6.145, as well as kernel 6.8 and later branches up to their respective fix commits. The CVSS estimate is Medium severity with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is a use-after-free / double-free memory management error (CWE-415) in the Linux kernel's SMB2 client replay logic. During an SMB2 close operation, if the first attempt returns a replayable error, the response buffer is freed. If SMB2_close_init() then fails before the next retry attempt, the cleanup code — still holding a stale pointer to the previously freed buffer — frees it a second time, corrupting kernel heap memory. The fix resets response bookkeeping state before each retry attempt to ensure stale pointers are never dereferenced or freed again (GitHub Advisory).

Successful exploitation can cause kernel memory corruption through a double-free condition, most directly resulting in a kernel panic and system crash (denial of service). A local user with the ability to trigger SMB2 close replay error conditions — for example, by interacting with a mounted SMB share under specific network error conditions — could exploit this flaw. There is no evidence of confidentiality or integrity impact beyond the availability loss caused by a kernel crash (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to trigger SMB2 replay error conditions, limiting its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.0, reflecting very low near-term exploitation probability (GitHub Advisory, Feedly).

Update the Linux kernel to a version containing the fix: 6.6.145 or later for the 6.6.x stable series; 6.12.96 or later for the 6.12.x series; 6.18.39 or later for the 6.18.x series; 7.1.4 or later for the 7.1.x series; or 7.2-rc1 and later for mainline. The fix is also available via specific stable commits: 037511726228 (6.6 branch), 0aa97edf7c34, d15d83125007, b18ed621dbfc, and f96e1cdcb63e for other affected branches. No configuration-based workaround is known; kernel update is the recommended remediation (GitHub Advisory).