CVE-2026-64437
published 2026-07-25CVE-2026-64437: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit…
PriorityP351high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.63%
48.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on
double SMB2_CANCEL") made smb2_cancel() skip a work whose state is
KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But
KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same
freeing producer path is reached for CLOSED too:
SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets
the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()
worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s
the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes
the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the
cancelled branch, skips release_async_work(). The work stays on
conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock
pointing at the freed file_lock.
A subsequent SMB2_CANCEL for the same AsyncId then passes the
KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so
smb2_cancel() fires cancel_fn again over the freed file_lock -- the same
use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:
BUG: KASAN: slab-use-after-free in __locks_delete_block
__locks_delete_block
locks_delete_block
ksmbd_vfs_posix_lock_unblock
smb2_remove_blocked_lock
smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn
handle_ksmbd_work
Allocated by ...: locks_alloc_lock <- smb2_lock
Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit)
... cache file_lock_cache of size 192
Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with
KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is
silent on that kernel, so the splat is attributable to the CLOSE trigger.
Only an ACTIVE deferred work may have its cancel_fn fired: both terminal
states (CANCELLED and CLOSED) reach the smb2_loc
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd < b8e274e69ab09222c7a552c7c0c1eef9ce627fc1 | b8e274e69ab09222c7a552c7c0c1eef9ce627fc1 |
| linux | linux | >= 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d < 94083db751930b1540ddff2b54d4677549c57f81 | 94083db751930b1540ddff2b54d4677549c57f81 |
| linux | linux | >= 6.1.176 < 6.1.178 | 6.1.178 |
| linux | linux | >= 6.12.94 < 6.12.96 | 6.12.96 |
| linux | linux | >= 6.18.36 < 6.18.39 | 6.18.39 |
| linux | linux | >= 6.6.143 < 6.6.145 | 6.6.145 |
| linux | linux | >= 7.0.13 < 7.1 | 7.1 |
| linux | linux | >= 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 < ddb9239828336b36d8a3ef5943fdffb2f55b6508 | ddb9239828336b36d8a3ef5943fdffb2f55b6508 |
| linux | linux | >= b7063c7426ea5a4d15e01b60538718765392f49d < a796ba4e61d5e14e07b79a359faac69f8f9b22a3 | a796ba4e61d5e14e07b79a359faac69f8f9b22a3 |
| linux | linux | >= f580d27e8928828693df44ba2db0fffdbe11dfea < 12c36c99655f325befe50c26842f7deca414c381 | 12c36c99655f325befe50c26842f7deca414c381 |
| linux | linux | >= f580d27e8928828693df44ba2db0fffdbe11dfea < 10f293a07f9e10e988b0ae44e2e99c631f5a68e0 | 10f293a07f9e10e988b0ae44e2e99c631f5a68e0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.1.176 < 6.1.178 | 6.1.178 |
| linux | linux_kernel | >= 6.12.94 < 6.12.96 | 6.12.96 |
| linux | linux_kernel | >= 6.18.36 < 6.18.39 | 6.18.39 |
| linux | linux_kernel | >= 6.6.143 < 6.6.145 | 6.6.145 |
| linux | linux_kernel | >= 7.0.13 < 7.1 | 7.1 |
| linux | linux_kernel | >= 7.1.1 < 7.1.4 | 7.1.4 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
vendor_redhat·2026-07-25·CVSS 8.8
CVE-2026-64437 [HIGH] CWE-825 kernel: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
kernel: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an authenticated client using the Server Message Block (SMB) protocol to trigger a use-after-free error. By sending specific close and cancel requests, an attacker can cause the kernel to crash, leading to a denial of service for affected systems.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
P
VulDB
Linux Kernel up to 7.1.3 Ksmbd smb2_cancel use after free (Nessus ID 329950)
vuldb·2026-09-04·CVSS 8.8
CVE-2026-64437 [HIGH] Linux Kernel up to 7.1.3 Ksmbd smb2_cancel use after free (Nessus ID 329950)
A vulnerability identified as very critical has been detected in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. This issue affects the function smb2_cancel of the component Ksmbd. The manipulation leads to use after free.
This vulnerability is traded as CVE-2026-64437. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free o
ghsa_unreviewed·2026-07-25
CVE-2026-64437 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free o
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on
double SMB2_CANCEL") made smb2_cancel() skip a work whose state is
KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But
KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same
freeing producer path is reached for CLOSED too:
SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets
the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()
worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s
the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes
the STATUS_RANGE_NOT_LOC
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0https://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381https://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81https://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3https://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1https://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508
2026-07-25
Published