CVE-2026-64396

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel ksmbd SMB2_LOCK Handling

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the connection's async_requests list via setup_async_work(). The cancel callback smb2_remove_blocked_lock() holds a reference to the flock. If the lock waiter is subsequently woken up but the work state is no longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the cleanup path calls locks_free_lock(flock) without dequeuing the work from the async_requests list. Concurrently, smb2_cancel() walks the list under conn->request_lock and invokes the cancel callback, which then dereferences the already freed 'flock'. This leads to a slab-use-after-free inside __wake_up_common. Fix this by restructuring the cleanup logic after the worker returns from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and release_async_work(work) to the top of the cleanup block. This guarantees that the async work is completely dequeued and serialized under conn->request_lock before locks_free_lock(flock) is called, rendering the flock unreachable for any concurrent smb2_cancel().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64396

EUVD

EUVD-2026-48940

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.15 (inc) to 6.1.178 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's ksmbd SMB server implementation. It occurs when a blocking byte-range lock request is deferred and later canceled. The issue arises because the cleanup process frees a file lock structure while another thread might still be accessing it, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using tools like dmesg to identify slab-use-after-free events in SMB2_LOCK operations. No direct network commands are available for detection.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems running vulnerable versions of the Linux kernel with ksmbd enabled.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's ksmbd SMB server, specifically in byte-range lock handling. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, as it involves memory corruption rather than unauthorized data access or disclosure. Compliance impact would depend on whether the affected system processes sensitive data, but the vulnerability itself is not a direct violation of these standards.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for the ksmbd UAF vulnerability in SMB2_LOCK deferred-lock cancellation. Disable ksmbd if not in use until patched.

Hi! I’m here to help you understand CVE-2026-64396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70