Vulnerability-Lookup

CVE-2026-64597 (GCVE-0-2026-64597)

Vulnerability from cvelistv5 – Published: 2026-08-06 07:13 – Updated: 2026-08-17 04:58

Title

smb: client: fix double-free in SMB2_close() replay

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/037511726228aaf16…
https://git.kernel.org/stable/c/0aa97edf7c347c0f5…
https://git.kernel.org/stable/c/d15d83125007f673a…
https://git.kernel.org/stable/c/b18ed621dbfceecea…
https://git.kernel.org/stable/c/f96e1cdcb63ed3321…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 433042a91f9373241307725b52de573933ffedbf , < 037511726228aaf165c7067ff2bfc88eaecdf1f3 (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < 0aa97edf7c347c0f54e7e60c4740574b8120c66a (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < d15d83125007f673aec4323e1bbbaaffbe87ea13 (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < b18ed621dbfceecea5539848cddcb9272c9a61e1 (git) Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < f96e1cdcb63ed3321142ff2fcdf784e32cda8fee (git) Affected: 6.6.32 , < 6.6.145 (semver)	guessed
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "037511726228aaf165c7067ff2bfc88eaecdf1f3",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "0aa97edf7c347c0f54e7e60c4740574b8120c66a",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "d15d83125007f673aec4323e1bbbaaffbe87ea13",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "b18ed621dbfceecea5539848cddcb9272c9a61e1",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB server triggers the double-free via crafted SMB2 CLOSE responses over the network, returning replayable NTSTATUS values that map to -EAGAIN/-ECONNABORTED while leaving a response buffer for the client to free.\nAC:L - The attacking server controls both sides of the sequence by returning a replayable CLOSE status with a response buffer, then dropping or forcing reconnect so SMB2_close_init fails before the next send, and can repeat until the stale free occurs.\nPR:N - The attacking SMB endpoint needs no account or privileges on the victim client; once an SMB session and handle exist, the server alone drives the vulnerable CLOSE replay path.\nUI:N - On an already mounted or automounted share, background paths such as cached-directory close and cancelled-close work, as well as routine service file closes, can invoke SMB2_close without interactive user action at exploit time.\nS:U - The mempool double-free corrupts kernel memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - Double-free of a CIFS small/large response buffer can create overlapping live allocations and use-after-free reads, enabling disclosure of arbitrary kernel memory.\nI:H - Reallocation of the freed mempool object with attacker-controlled network data can corrupt live kernel objects or allocator metadata, enabling arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can immediately trigger allocator BUG diagnostics, heap corruption, oops, or panic, and the server can retrigger the path repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:19.742Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13"
        },
        {
          "url": "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_close() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64597",
    "datePublished": "2026-08-06T07:13:52.117Z",
    "dateReserved": "2026-07-19T15:36:31.799Z",
    "dateUpdated": "2026-08-17T04:58:19.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64597",
      "date": "2026-09-18",
      "epss": "0.00359",
      "percentile": "0.29678"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "037511726228aaf165c7067ff2bfc88eaecdf1f3",
                    "status": "affected",
                    "version": "433042a91f9373241307725b52de573933ffedbf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0aa97edf7c347c0f54e7e60c4740574b8120c66a",
                    "status": "affected",
                    "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d15d83125007f673aec4323e1bbbaaffbe87ea13",
                    "status": "affected",
                    "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b18ed621dbfceecea5539848cddcb9272c9a61e1",
                    "status": "affected",
                    "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
                    "status": "affected",
                    "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.32",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
          }
        ],
        "id": "CVE-2026-64597",
        "lastModified": "2026-08-17T05:18:06.207",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-06T08:16:35.340",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-10T03:17:06+00:00",
      "cve": "CVE-2026-64597",
      "id": "CVE-2026-64597",
      "initial_release_date": "2026-08-06T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "23",
      "product_status:known_not_affected": "92",
      "product_status:under_investigation": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix double-free in SMB2_close() replay",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64597.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:37:25Z",
      "cve": "CVE-2026-64597",
      "id": "CVE-2026-64597",
      "initial_release_date": "2026-08-06T23:55:31Z",
      "product_status:known_affected": "480",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "194",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64597",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64597.json",
      "version": "12"
    }
  }
}

OPENSUSE-SU-2026:11476-1

Vulnerability from csaf_opensuse - Published: 2026-08-09 00:00 - Updated: 2026-09-17 17:18

Summary

kernel-devel-7.1.7-1.1 on GA media

Severity

Moderate

Scope

351 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 16 products

Open the full advisory

RHSA-2026:64775

Vulnerability from csaf_opensuse - Published: 2026-09-08 09:06 - Updated: 2026-09-17 12:42

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

22 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A vulnerability exists in the SMB2_close() replay mechanism where a response buffer can be freed twice. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of arbitrary code.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 309 products

https://access.redhat.com/errata/RHSA-2026:64775

Open the full advisory

RHSA-2026:66180

Vulnerability from csaf_opensuse - Published: 2026-09-10 00:39 - Updated: 2026-09-17 12:42

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

17 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 303 products

https://access.redhat.com/errata/RHSA-2026:66180

Open the full advisory

RLSA-2026:64775 (CVE-2025-38004)

Vulnerability from osv_rocky – Published: 2026-09-09 12:09 – Updated: 2026-09-19 00:13 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)
kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)
kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)
kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)
kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

Bug Fix(es) and Enhancement(s):

Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [Rocky Linux 10.2] (JIRA:Rocky Linux-132852)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:64775	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2484456	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2370992	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2510892	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507041	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2460736	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2511932	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507096	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492745	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2454807	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492295	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502363	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502369	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492841	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2481936	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492725	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492733	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492097	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468102	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492850	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492811	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507129	REPORT
	https://access.redhat.com/errata/RHSA-2026:64775	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-10\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:6.12.0-211.52.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:64775"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)\n\n* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)\n\n* kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)\n\n* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)\n\n* kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)\n\n* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)\n\n* kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv6: anycast: insert aca into global hash under idev-\u003elock (CVE-2026-53259)\n\n* kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)\n\n* kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)\n\n* kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)\n\n* kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)\n\n* kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)\n\n* kernel: rhashtable: clear stale iter-\u003ep on table restart (CVE-2026-64563)\n\n* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)\n\nBug Fix(es) and Enhancement(s):\n\n* Customer needs \"netfilter: nfnetlink_queue: optimize verdict lookup with hash table\" patch [Rocky Linux 10.2] (JIRA:Rocky Linux-132852)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:64775",
  "modified": "2026-09-19T00:13:54.741402Z",
  "published": "2026-09-09T12:09:16.585859Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:64775"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370992"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507041"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460736"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511932"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507096"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492745"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454807"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492295"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502363"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502369"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481936"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492725"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492733"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492097"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492850"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507129"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:64775"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2025-38004",
    "CVE-2026-23442",
    "CVE-2026-31503",
    "CVE-2026-43339",
    "CVE-2026-46015",
    "CVE-2026-46266",
    "CVE-2026-46306",
    "CVE-2026-52933",
    "CVE-2026-53075",
    "CVE-2026-53223",
    "CVE-2026-53228",
    "CVE-2026-53235",
    "CVE-2026-53259",
    "CVE-2026-53275",
    "CVE-2026-53277",
    "CVE-2026-63993",
    "CVE-2026-64002",
    "CVE-2026-64265",
    "CVE-2026-64287",
    "CVE-2026-64319",
    "CVE-2026-64563",
    "CVE-2026-64597"
  ]
}

RLSA-2026:66180 (CVE-2026-43133)

Vulnerability from osv_rocky – Published: 2026-09-11 12:05 – Updated: 2026-09-19 00:13 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:66180	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2467065	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468102	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2481936	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482566	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2484456	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486999	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492811	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492841	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2501252	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502394	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2510892	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2511932	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516731	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517046	REPORT
	https://access.redhat.com/errata/RHSA-2026:66180	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.46.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:66180"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)\n\n* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: Revert \"net/smc: Introduce TCP ULP support\" (CVE-2026-46330)\n\n* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)\n\n* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)\n\n* kernel: rhashtable: clear stale iter-\u003ep on table restart (CVE-2026-64563)\n\n* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)\n\n* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)\n\n* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)\n\nBug Fix(es) and Enhancement(s):\n\n* KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:66180",
  "modified": "2026-09-19T00:13:50.762962Z",
  "published": "2026-09-11T12:05:26.835797Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:66180"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481936"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482566"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486999"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501252"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502394"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511932"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516731"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517046"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:66180"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43133",
    "CVE-2026-43339",
    "CVE-2026-43493",
    "CVE-2026-46015",
    "CVE-2026-46149",
    "CVE-2026-46266",
    "CVE-2026-46306",
    "CVE-2026-46330",
    "CVE-2026-53002",
    "CVE-2026-53223",
    "CVE-2026-53275",
    "CVE-2026-53366",
    "CVE-2026-64034",
    "CVE-2026-64563",
    "CVE-2026-64597",
    "CVE-2026-72129",
    "CVE-2026-74480"
  ]
}

SUSE-SU-2026:23477-1

Vulnerability from csaf_suse - Published: 2026-09-08 12:54 - Updated: 2026-09-17 16:21

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:23481-1

Vulnerability from csaf_suse - Published: 2026-09-08 13:00 - Updated: 2026-09-17 16:21

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 11 products

Open the full advisory

SUSE-SU-2026:23528-1

Vulnerability from csaf_suse - Published: 2026-09-08 10:34 - Updated: 2026-09-17 16:22

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23529-1

Vulnerability from csaf_suse - Published: 2026-09-08 11:00 - Updated: 2026-09-17 16:22

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:4120-1

Vulnerability from csaf_suse - Published: 2026-09-10 09:31 - Updated: 2026-09-18 09:16

Summary

Security update for the Linux Kernel

Severity

Important

Scope

662 vulnerabilities in this advisory, including CVE-2026-64597.

CVE-2026-64597

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 19 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-64597 (GCVE-0-2026-64597)

RLSA-2026:64775 (CVE-2025-38004)

RLSA-2026:66180 (CVE-2026-43133)

Tags

Sightings

Nomenclature

Related by attack behaviour