External risk intelligence

Linux Kernel SMB Client Double-Free Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64597

This vulnerability affects the Linux kernel SMB client implementation, which operates at the internal kernel level. It is not a public-facing service or application that listens on the internet, but rather a client-side component used for file system operations, making it highly unlikely to be exposed as an internet-facing attack surface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was resolved in the Linux kernel affecting its SMB client, which could lead to system instability. The main concern is confirming its relevance and exposure within our environment, as this issue impacts an internal kernel component rather than a direct internet-facing service.

Kernel flaw impacts file sharing.
Matters for system stability assurance.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to a Linux system that uses the SMB client. This could cause the system to free memory twice, potentially leading to a crash or other unpredictable behavior.

Network access required.
Triggered by a replayable error in SMB2.
Leads to memory corruption and instability.

Live Threat

Current exploitation, exposure, and threat context

A double-free vulnerability in the Linux kernel's SMB client could allow an attacker to cause a denial of service when handling SMB2 close operations. This might occur when a replayable error is returned, leading to a freed response buffer being freed again.

Kernel memory corruption
Replayable errors trigger double-free
System instability or crash

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SMB client could impact systems that use SMB for file sharing. Infrastructure or platform teams are likely responsible for managing the kernel and its components. The first step is to identify all systems running the affected Linux kernel version, determine their exposure to SMB network traffic, and assess their business criticality to prioritize remediation efforts.

Infrastructure/Platform teams own this issue.
Verify SMB client reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SMB client?

The SMB client is a core component within the Linux kernel that allows your operating system to communicate with remote servers using the Server Message Block protocol. It is primarily used for mounting network drives and sharing files across enterprise networks, acting as a translator that enables the kernel to read and write data from distant storage resources.

What does a double-free vulnerability mean in CVE-2026-64597?

This is a memory management error where the kernel attempts to release the same area of memory twice. When the system incorrectly tracks whether a buffer has already been cleared, it can trigger a conflict. This specific flaw happens during the SMB2 close process, potentially leading to unpredictable system behavior or a crash when the kernel tries to process a response that it mistakenly believes is still active.

How is this SMB client vulnerability triggered?

An attacker triggers this by sending specifically crafted network packets to a system actively using the SMB client. The issue is linked to how the system handles certain replayable errors during an SMB2 close operation. Notably, simply having the SMB client installed or running does not trigger the bug; the system must be actively communicating with an attacker-controlled or malicious source that sends these problematic packets.

Is my system at risk according to Halo Surface Signal?

According to Halo Surface Signal, this is considered very unlikely to be exposed on the public internet. Because the SMB client operates as an internal kernel-level component rather than a service that listens for incoming connections, it does not typically present a direct internet-facing attack surface. Risk is generally localized to environments where the kernel handles untrusted or suspicious network traffic.

What should I do first to address this CVE?

Your first step is to work with your infrastructure or platform teams to generate an inventory of systems running the affected Linux kernel versions. Once identified, evaluate which of those systems are actively performing SMB-based file sharing. Prioritize your remediation efforts by focusing on those assets based on their business criticality and their likelihood of interacting with unknown or untrusted network segments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.