PT-2026-61333 · Linux · Linux

CVE-2026-64016 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix durable reconnect error path file lifetime

After a durable reconnect succeeds, ksmbd reopen durable fd() republishes the same ksmbd file into the session volatile-id table. If smb2 open() then takes a later error path, cleanup first calls ksmbd fd put(work, fp) and then unconditionally calls ksmbd put durable fd(dh info.fp).

In this case fp and dh info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run ksmbd close fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table.

Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh info.fp, keep using the durable-only put path.

Fix

Related Identifiers

CVE-2026-64016

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64016 · Security Note
• https://git.kernel.org/stable/c/a1a39f227c80cbf369767badc32cba2b225147d1 · Note
• https://git.kernel.org/stable/c/6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3 · Note
• https://git.kernel.org/stable/c/3515503322f4819277091839eed46b695096aca5 · Note