CVE-2026-64437

Analyzed Analyzed - Analysis Complete

Use-After-Free in ksmbd Linux Kernel SMB Server

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too: SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock() worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the cancelled branch, skips release_async_work(). The work stays on conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock. A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL: BUG: KASAN: slab-use-after-free in __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit) ... cache file_lock_cache of size 192 Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger. Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64437

EUVD

EUVD-2026-48781

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 7.0.13 (inc) to 7.1 (exc)
linux	linux_kernel	From 6.1.176 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.6.143 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 7.1.1 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.12.94 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.18.36 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ksmbd implementation. It occurs when an SMB2_CLOSE operation is followed by an SMB2_CANCEL on the same file lock. The issue stems from improper state handling where a deferred file_lock is freed but its cancel function remains active, leading to a use-after-free when the cancel function is triggered again.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and involves a use-after-free condition in file locking. Detection requires checking for kernel logs indicating slab-use-after-free errors in the ksmbd module, particularly related to locks_alloc_lock and locks_free_lock. Monitor logs for KASAN reports or kernel oops messages involving smb2_cancel or smb2_lock functions.

Impact Analysis

An attacker with authenticated SMB access could exploit this to cause a kernel crash or execute arbitrary code with kernel privileges. This could lead to denial of service, data corruption, or unauthorized system access on affected systems running vulnerable ksmbd versions.

Compliance Impact

This vulnerability involves a use-after-free flaw in the Linux kernel's ksmbd SMB server implementation, specifically related to file locking operations. While the technical details describe a memory corruption issue, compliance impacts are not explicitly mentioned in the provided context. Use-after-free vulnerabilities can potentially lead to unauthorized data access or system instability, which may affect compliance with standards requiring data integrity and security, such as GDPR or HIPAA. However, specific compliance implications cannot be determined from the given information.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description (commit f580d27e8928) or update to a kernel version that includes this fix. Disable the ksmbd service if not in use. Monitor vendor advisories for distribution-specific patches. Ensure SMB services are not exposed to untrusted networks.

Hi! I’m here to help you understand CVE-2026-64437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70