CVE-2026-64016
Received Received - Intake

ksmbd File Lifetime Issue in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64016
EUVD
EUVD-2026-45589

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the ksmbd component. It involves a flaw in the durable reconnect error handling where a file object is incorrectly managed after a reconnect attempt. The issue occurs when cleanup routines improperly drop references to the same file object twice, leading to a use-after-free scenario where the file is freed without removing its entry from the session table.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level inspection. Detection involves checking kernel logs for durable reconnect errors or examining the ksmbd module for version mismatches. Commands like dmesg | grep ksmbd or journalctl -u ksmbd may help identify issues.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or corrupting kernel memory. It may also lead to unauthorized access or data leaks if the file object is manipulated improperly during the error path execution.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to file handling in the ksmbd component, which could lead to resource leaks or improper cleanup but does not involve data breaches or unauthorized access that would typically impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest patched version. If using ksmbd, ensure the module is updated. Restart services dependent on ksmbd after applying patches. Monitor kernel logs for errors post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart