Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) could allow an authenticated user to cause a system crash. The issue occurs when specific file locking requests are closed and then cancelled in a specific sequence, leading to memory corruption. This could disrupt file sharing services and impact overall system availability.
Technical details
A use-after-free (UAF) vulnerability exists in the ksmbd component of the Linux kernel due to improper state management of deferred file locks. When an SMB2_CLOSE command is issued on a locking handle, the work state is set to KSMBD_WORK_CLOSED, which triggers the freeing of the associated file_lock object but fails to remove the work from the asynchronous request list. A subsequent SMB2_CANCEL request for the same AsyncId then attempts to execute the cancellation function on the already-freed file_lock object. This vulnerability requires an authenticated SMB client to exploit and can lead to a kernel panic (denial of service). The fix ensures that only works in the KSMBD_WORK_ACTIVE state can have their cancellation functions fired.
Affected products
- Linux Linux Kernel 7.1-rc7 and earlier versions
Timeline
- 2026-06-10: disclosed: Initial patch authored
- 2026-07-25: advisory: CVE-2026-64437 published
References
- https://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0
- https://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381
- https://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81
- https://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3
- https://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1
- https://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508