External risk intelligence

Linux Kernel SMB Client Double-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64387

This vulnerability exists within the Linux kernel's SMB client implementation, which is used for mounting remote file systems. SMB client operations are initiated by the local host and are not exposed as internet-facing services, making it extremely unlikely for this specific component to be reachable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been resolved in the Linux kernel affecting its SMB client. This issue could allow for a double-free memory corruption, potentially leading to broader system instability or compromise. The main concern at this stage is confirming whether this specific functionality is in use within our environment.

Memory corruption flaw in Linux SMB client.
Critical rating, potential for system-wide impact.
Confirm relevance and any potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network responses to a Linux system attempting to access a remote file share. This targets the SMB client component, and if successful, could lead to a denial-of-service condition due to a double-free memory error.

Network access required.
Replayable error triggers vulnerability.
Denial of service risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's SMB client could potentially allow an attacker to trigger a double-free error when handling directory query responses. This might lead to system instability or crashes when supported by the advisory's conditions, impacting the availability of the affected system.

Kernel memory integrity.
Replayable error response triggers double-free.
System instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's SMB client component is likely managed by infrastructure or platform teams. The first practical step is to determine if any Linux systems are configured to use the SMB client, assess their business criticality, and identify the system owner for remediation planning.

Identify Linux systems using SMB client.
Verify SMB client reachability and criticality.
Plan remediation with system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SMB client?

The SMB client is a component within the Linux kernel that allows a system to connect to and mount remote file shares, such as those hosted on Windows servers or NAS devices. It acts as the intermediary, enabling the local operating system to read from and write to files on networked storage as if they were located on the local disk.

Why does CVE-2026-64387 cause a double-free error?

This vulnerability is a memory management flaw known as a double-free. It occurs when the kernel attempts to release the same memory buffer twice. In this specific case, if a directory query fails and is flagged for retry, the system incorrectly reuses and frees a stale buffer from a previous attempt, leading to memory corruption that can destabilize the kernel.

How can an attacker trigger this vulnerability?

An attacker must be able to influence the network responses received by a Linux system that is actively communicating with a remote SMB share. Simply having a Linux machine on a network does not trigger this; the system must be in the middle of a specific directory query operation that encounters a replayable error response crafted to exploit the flaw.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this risk is very unlikely because the SMB client initiates outgoing connections to remote shares rather than listening for incoming traffic. Since this component is not typically exposed as an internet-facing service, it is generally unreachable from the public internet, which significantly reduces the potential for remote exploitation.

Do I need to take action for CVE-2026-64387?

Your first step should be to inventory your environment to identify which Linux systems are configured to mount remote SMB shares. Once identified, prioritize these systems based on their business function. You do not need to take emergency action for every device, but you should coordinate with system owners to track when kernel updates become available for your specific Linux distribution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.