CVE-2026-64016

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-07-19

Last updated on: 2026-10-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64016

EUVD

EUVD-2026-45589

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	6.18.33
linux	linux_kernel	7.0.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the ksmbd component. It involves a flaw in the durable reconnect error handling where a file object is incorrectly managed after a reconnect attempt. The issue occurs when cleanup routines improperly drop references to the same file object twice, leading to a use-after-free scenario where the file is freed without removing its entry from the session table.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level inspection. Detection involves checking kernel logs for durable reconnect errors or examining the ksmbd module for version mismatches. Commands like dmesg | grep ksmbd or journalctl -u ksmbd may help identify issues.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or corrupting kernel memory. It may also lead to unauthorized access or data leaks if the file object is manipulated improperly during the error path execution.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to file handling in the ksmbd component, which could lead to resource leaks or improper cleanup but does not involve data breaches or unauthorized access that would typically impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest patched version. If using ksmbd, ensure the module is updated. Restart services dependent on ksmbd after applying patches. Monitor kernel logs for errors post-update.

Hi! I’m here to help you understand CVE-2026-64016. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70