CVE-2026-64016 (GCVE-0-2026-64016)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
ksmbd: fix durable reconnect error path file lifetime
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ce2e164c1c51c3f7813b80f8c926836e896bcbb3 , < a1a39f227c80cbf369767badc32cba2b225147d1 (git)
Affected: 97a0cd55283b4e63fd92804da91c8d9896adcad9 , < 6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3 (git)
Affected: 1baff47b81f94f9231c91236aa511420d0e266b9 , < 3515503322f4819277091839eed46b695096aca5 (git)
Create a notification for this product.
Linux Linux Affected: 6.18.33 , < 6.18.34 (semver)
Affected: 7.0.10 , < 7.0.11 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a1a39f227c80cbf369767badc32cba2b225147d1",
              "status": "affected",
              "version": "ce2e164c1c51c3f7813b80f8c926836e896bcbb3",
              "versionType": "git"
            },
            {
              "lessThan": "6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3",
              "status": "affected",
              "version": "97a0cd55283b4e63fd92804da91c8d9896adcad9",
              "versionType": "git"
            },
            {
              "lessThan": "3515503322f4819277091839eed46b695096aca5",
              "status": "affected",
              "version": "1baff47b81f94f9231c91236aa511420d0e266b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.18.34",
              "status": "affected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.11",
              "status": "affected",
              "version": "7.0.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.18.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "7.0.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix durable reconnect error path file lifetime\n\nAfter a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes\nthe same ksmbd_file into the session volatile-id table. If smb2_open()\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).\n\nIn this case fp and dh_info.fp are the same object. The first put drops the\nreconnect lookup reference, but the final durable put can run\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,\nit can free the file object without removing the volatile-id entry that was\njust published into the session table.\n\nUse the session-aware put for the final reconnect drop when the reconnect\nhad already succeeded and the error path is cleaning up the republished\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep\nusing the durable-only put path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is reached through ksmbd\u0027s in-kernel SMB2 server on TCP port 445 via SMB2_CREATE durable-handle reconnect processing in smb2_open(), reachable by any remote SMB client that can connect to the server.\nAC:L - An authenticated attacker can fully control the durable reconnect sequence (open with durable handle, disconnect to preserve it, reconnect, then force a post-reconnect error such as ksmbd_iov_pin_rsp() ENOMEM) and immediately exercise the stale volatile file ID via further SMB2 operations.\nPR:N - Exploitation requires only network reachability to ksmbd and valid SMB session credentials (guest or any share user); no elevated kernel privileges, capabilities, or local access are needed beyond what any remote SMB client possesses.\nUI:N - No victim user interaction is required beyond the server running ksmbd with durable handles enabled; the attacker drives the entire reconnect-and-error sequence over the network.\nS:U - The use-after-free corrupts kernel heap memory within the ksmbd server context and can lead to privilege escalation on the host, but does not cross a VM, container, or IOMMU security boundary.\nC:H - Freeing the ksmbd_file while its volatile ID remains in the session IDR creates a use-after-free; subsequent ksmbd_lookup_fd_slow() dereferences freed slab memory, enabling kernel information disclosure.\nI:H - The UAF corrupts kernel heap objects (struct ksmbd_file in the filp kmem cache) and can be leveraged with heap grooming for arbitrary kernel memory writes or code execution.\nA:H - Use-after-free of the ksmbd_file object can cause kernel oopses or panics when freed memory is reused or dereferenced during subsequent SMB2 file operations on the stale volatile ID."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:13.419Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a1a39f227c80cbf369767badc32cba2b225147d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3515503322f4819277091839eed46b695096aca5"
        }
      ],
      "title": "ksmbd: fix durable reconnect error path file lifetime",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64016",
    "datePublished": "2026-07-19T15:39:11.266Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:13.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64016",
      "date": "2026-08-11",
      "epss": "0.00442",
      "percentile": "0.36491"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64016\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:41.577\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix durable reconnect error path file lifetime\\n\\nAfter a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes\\nthe same ksmbd_file into the session volatile-id table. If smb2_open()\\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)\\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).\\n\\nIn this case fp and dh_info.fp are the same object. The first put drops the\\nreconnect lookup reference, but the final durable put can run\\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,\\nit can free the file object without removing the volatile-id entry that was\\njust published into the session table.\\n\\nUse the session-aware put for the final reconnect drop when the reconnect\\nhad already succeeded and the error path is cleaning up the republished\\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep\\nusing the durable-only put path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ce2e164c1c51c3f7813b80f8c926836e896bcbb3\",\"lessThan\":\"a1a39f227c80cbf369767badc32cba2b225147d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97a0cd55283b4e63fd92804da91c8d9896adcad9\",\"lessThan\":\"6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1baff47b81f94f9231c91236aa511420d0e266b9\",\"lessThan\":\"3515503322f4819277091839eed46b695096aca5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18.33\",\"lessThan\":\"6.18.34\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.0.10\",\"lessThan\":\"7.0.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3515503322f4819277091839eed46b695096aca5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a1a39f227c80cbf369767badc32cba2b225147d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:05:40+00:00",
      "cve": "CVE-2026-64016",
      "id": "CVE-2026-64016",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix durable reconnect error path file lifetime",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64016.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-07-21T13:01:29Z",
      "cve": "CVE-2026-64016",
      "id": "CVE-2026-64016",
      "initial_release_date": "2026-07-21T13:01:29Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64016",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64016.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.