CVE-2026-64396 - Vulnerability Details

- ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

When a blocking byte-range lock request is deferred in the
FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into
the connection's async_requests list via setup_async_work(). The cancel
callback smb2_remove_blocked_lock() holds a reference to the flock.

If the lock waiter is subsequently woken up but the work state is no
longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the
cleanup path calls locks_free_lock(flock) without dequeuing the work from
the async_requests list. Concurrently, smb2_cancel() walks the list
under conn->request_lock and invokes the cancel callback, which then
dereferences the already freed 'flock'. This leads to a slab-use-after-free
inside __wake_up_common.

Fix this by restructuring the cleanup logic after the worker returns
from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and
release_async_work(work) to the top of the cleanup block. This guarantees
that the async work is completely dequeued and serialized under
conn->request_lock before locks_free_lock(flock) is called, rendering
the flock unreachable for any concurrent smb2_cancel().

Published: 2026-07-25

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free bug was discovered in the Linux kernel’s ksmbd SMB server component, specifically when a deferred byte‑range lock is cancelled. The bug allows a freed file_lock structure to be dereferenced by an asynchronous cancellation callback, causing a breach of kernel memory safety. While the description does not explicitly state the resulting effects, such a flaw can lead to kernel memory corruption, possible crash (Denial of Service), or in the best‑case scenario, code execution if the attacker can reliably control the freed memory contents. The vulnerability is classified under CWE‑825.

Affected Systems

Any Linux installation that includes the ksmbd SMB server module is potentially affected. The CVE documentation does not list a specific kernel version range; therefore, any kernel build that contains the ksmbd code path may be vulnerable until the patch is applied.

Risk and Exploitability

The CVSS score of 8.8 points to a high severity issue. The EPSS score of less than 1% indicates a low probability that this vulnerability is being actively exploited in the wild. It is not currently listed in the CISA KEV catalog. The most likely attack vector is via an SMB client that requests a blocking byte‑range lock and then cancels it concurrently, which would trigger the race condition. This assessment is inferred from the description and has not been directly observed in the public threat landscape.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 367c42a611fe488b7b03f1f6737f4dee0e8b20a2
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 7703fd9aba1f2483c8e55f9ff73b7663e0761ed9
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 463bbd79698513af4dad50fe1c573825f297ca2e
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 5aa1cb01155f96824003baf7997cdf1f150caba3
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 5c75275c0fc9a2deb0d8f5604edcb16f288171c8
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,367c42a611fe488b7b03f1f6737f4dee0e8b20a2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7703fd9aba1f2483c8e55f9ff73b7663e0761ed9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,463bbd79698513af4dad50fe1c573825f297ca2e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5aa1cb01155f96824003baf7997cdf1f150caba3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5c75275c0fc9a2deb0d8f5604edcb16f288171c8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e)`	affected	code_commit	—
`[0,6.1.178)`	affected	semver	—
`[0,6.6.145)`	affected	semver	—
`[0,6.12.96)`	affected	semver	—
`[0,6.18.39)`	affected	semver	—
`[0,7.1.4)`	affected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that incorporates the ksmbd use‑after‑free patch
Ensure the system boots with the updated kernel and that no older kernel versions remain selectable
If a kernel upgrade cannot be applied immediately, consider disabling SMB lock support or restricting SMB access to trusted clients to limit the attack surface

Generated by OpenCVE AI on August 4, 2026 at 14:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00435.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2
https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e
https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3
https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8
https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9
https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e
https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64396-7ca2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64396
https://www.cve.org/CVERecord?id=CVE-2026-64396

History

Mon, 03 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 29 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64396-7ca2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64396 https://www.cve.org/CVERecord?id=CVE-2026-64396

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 26 Jul 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the connection's async_requests list via setup_async_work(). The cancel callback smb2_remove_blocked_lock() holds a reference to the flock. If the lock waiter is subsequently woken up but the work state is no longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the cleanup path calls locks_free_lock(flock) without dequeuing the work from the async_requests list. Concurrently, smb2_cancel() walks the list under conn->request_lock and invokes the cancel callback, which then dereferences the already freed 'flock'. This leads to a slab-use-after-free inside __wake_up_common. Fix this by restructuring the cleanup logic after the worker returns from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and release_async_work(work) to the top of the cleanup block. This guarantees that the async work is completely dequeued and serialized under conn->request_lock before locks_free_lock(flock) is called, rendering the flock unreachable for any concurrent smb2_cancel().
Title		ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2 https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3 https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8 https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9 https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:40.993Z

Updated: 2026-08-05T12:41:34.061Z

Reserved: 2026-07-19T15:36:31.785Z

Link: CVE-2026-64396

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:23.040

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64396

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64396 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:30:10Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object