Description
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix durable reconnect error path file lifetime

After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes
the same ksmbd_file into the session volatile-id table. If smb2_open()
then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)
and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).

In this case fp and dh_info.fp are the same object. The first put drops the
reconnect lookup reference, but the final durable put can run
__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,
it can free the file object without removing the volatile-id entry that was
just published into the session table.

Use the session-aware put for the final reconnect drop when the reconnect
had already succeeded and the error path is cleaning up the republished
file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep
using the durable-only put path.
Published: 2026-07-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Kernel Crash)
Action: Immediate Patch
AI Analysis

Impact

The Linux kernel’s ksmbd service contains a flaw in its durable reconnect logic where a file descriptor that has already been republished into a session table can be released twice. The first release drops a reference used for reconnection tracking; a second, unconditional release calls a session‑agnostic close routine that frees the file object while the session’s volatile‑id entry still points to it. This use‑after‑free can corrupt memory or crash the kernel, potentially causing a denial of service.

Affected Systems

All Linux kernel installations that include the ksmbd daemon and have not yet integrated the fix from the commit series that introduced ksmbd_reopen_durable_fd adjustments. The patch was published in mid‑2026, so any kernel built from source or binary packages before that date remains vulnerable.

Risk and Exploitability

The CVSS score of 9.8 denotes a critical severity, while the EPSS score of < 1% indicates a low probability of exploitation. Based on the description, it is inferred that an attacker would need to send SMB traffic to the host to trigger the double release path. Successful exploitation could lead to denial of service or memory corruption. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 17, 2026 at 10:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a patched version that includes the ksmbd durability fix.
  • If an immediate kernel upgrade is not possible, isolate the affected system from SMB clients or disable the ksmbd service until a patch can be applied.
  • As a temporary containment, block SMB traffic on the affected host or restrict SMB connections to trusted IP addresses until the kernel update is applied.

Generated by OpenCVE AI on October 17, 2026 at 10:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:6.18.33:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*

Mon, 14 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
References

Sun, 26 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-673

Wed, 22 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 21 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-673

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 19 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path.
Title ksmbd: fix durable reconnect error path file lifetime
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-14T11:58:34.345Z

Reserved: 2026-07-19T07:54:57.027Z

Link: CVE-2026-64016

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-19T16:17:41.577

Modified: 2026-10-13T14:48:12.317

Link: CVE-2026-64016

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64016 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:00:07Z

Weaknesses