{
  "threat_severity" : "Important",
  "public_date" : "2026-07-25T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: smb: client: fix query_info() replay double-free",
    "id" : "2507216",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2507216"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1341",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix query_info() replay double-free\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_info_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\nReset response bookkeeping before each attempt to prevent the stale free.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability, a double-free error, occurs when the `query_info()` replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2 query before the next data send, leading to the same memory being freed twice. Such an issue can result in memory corruption, potentially causing a denial of service (DoS) condition for the system." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57251",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.49.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57252",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.41.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "erlang27",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "impact" : "moderate"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-64386\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64386\nhttps://lore.kernel.org/linux-cve-announce/2026072526-CVE-2026-64386-9e73@gregkh/T" ],
  "name" : "CVE-2026-64386",
  "csaw" : false
}