The CVSS 9.8 for CVE-2026-64385 is defensible, but the more important question for defenders is whether this kernel heap double-free in the SMB2_ioctl() replay path crosses from a denial-of-service vector into an exploitable memory corruption primitive—because that distinction changes your entire response posture.
The vulnerability lives in the SMB client driver's retry logic. When a replayable error is received, the response buffer gets freed. If a subsequent retry fails during SMB2_ioctl_init() before sending, the cleanup handler executes and finds stale buffer-type bookkeeping still set—calling smb2_free_rsp_buf() on already-freed memory. The fix resets response bookkeeping (the buffer type indicator and pointer) before each retry attempt, preventing the cleanup from finding stale state.
What makes this CVSS 9.8 is the kernel context: a kernel heap double-free creates a window where an attacker could manipulate heap layout and achieve controlled memory corruption, not just trigger a panic. The 'response-bearing attempt' language in the advisory indicates the freed buffer held data, which theoretically could be reallocated and overwritten before the second free executes.
Two questions determine whether this is a practical privilege escalation vector on your systems:
First: can unprivileged local users trigger the SMB2_ioctl() replay path, or does this require an authenticated SMB session? The SMB client driver can be invoked through filesystem mounts, and many Linux configurations permit unprivileged mount operations. If any local user can trigger this path, severity stays high. If it requires an established SMB session with credentials, the attack surface narrows considerably.
Second: examine your kernel's SMB client configuration and whether the client is actively connecting to untrusted servers. The exploitability depends on allocation patterns in the kernel heap at that specific call site—which varies by kernel version, configuration, and workload.
The EPSS of 0.00457 suggests modest automated exploitation, but that metric lags behind changes in Linux's attack surface (unprivileged mounts, user namespaces). Targeted exploitation against high-value Linux infrastructure won't appear in aggregate EPSS data.
Prioritize patching on systems running the SMB client against untrusted networks, and audit whether local unprivileged users can trigger SMB mount operations. If the client is only used in trusted environments with authenticated sessions, this may warrant lower prioritization than the CVSS suggests—but the kernel heap double-free nature means it should not be dismissed as a simple DoS.