Executive brief
A vulnerability was identified in the Linux kernel's ksmbd component, which provides SMB file sharing services. The flaw involves a race condition in how the system cleans up expired file handles, potentially leading to memory corruption or a system crash. In a worst-case scenario, this could impact the stability of the file server and the integrity of active data sessions.
Technical details
The vulnerability exists within the ksmbd_durable_scavenger() function due to two primary race conditions. First, the scavenger reuses the 'fp->node' list_head for a local list while it is still linked to 'f_ci->m_fp_list', leading to list corruption. Second, a reference counting race allows the scavenger to free a file pointer (fp) while another thread (such as ksmbd_lookup_fd_inode) still holds a reference, resulting in a use-after-free (UAF). These issues occur during the background expiration of durable SMB2 handles. The fix involves introducing transient references to ensure proper object lifetime management and preventing list head reuse.
Affected products
- Linux Linux Kernel ksmbd module
Timeline
- 2026-07-19: advisory: CVE-2026-64142 published
- 2026-06-01: patched: Fixes committed to stable kernel branches
References
- https://git.kernel.org/stable/c/1f8f3246d55f89350a1a67bdf3744b7241048e4e
- https://git.kernel.org/stable/c/3a436932eb397e909d0607d76a8325abd9d85a35
- https://git.kernel.org/stable/c/5da69a65b282d2276de22e5194ba0f88c836170c
- https://git.kernel.org/stable/c/95f072ef934ca00711d510676b8792cbf59a5aae
- https://git.kernel.org/stable/c/bf736184d063da1a552ffeff0481813599a182cc