CVE-2026-64390 (GCVE-0-2026-64390)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
Title
ksmbd: track the connection owning a byte-range lock
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichannel, the connection handling the LOCK request can be different from the connection which opened the file. The entry can therefore be removed under a different spinlock from the one protecting the list it belongs to. A concurrent traversal can then access freed struct ksmbd_lock and struct file_lock objects. Record the connection owning each lock's clist entry and hold a reference to it while the entry is linked. Use that connection and its llist_lock for unlock, rollback, close, and durable preserve. Durable reconnect assigns the new connection as the owner when publishing the locks again.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 22d38cf75b556c20b039743bdf3654d535b858be (git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 66eb3643164e5e1029907793926c132f8b5c6148 (git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < ea5c9bf99f626a15cc59f645dc895f2b3f01992e (git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < fe20d492a69a6f79e637f438072b212e21ed3b78 (git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 427faaa52b0b399940c1a88065a5c310d10dad15 (git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 5fecc15a30cb9ebd310f7b52c1ab607edcea78f6 (git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs_cache.c",
            "fs/smb/server/vfs_cache.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22d38cf75b556c20b039743bdf3654d535b858be",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "66eb3643164e5e1029907793926c132f8b5c6148",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "ea5c9bf99f626a15cc59f645dc895f2b3f01992e",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "fe20d492a69a6f79e637f438072b212e21ed3b78",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "427faaa52b0b399940c1a88065a5c310d10dad15",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "5fecc15a30cb9ebd310f7b52c1ab607edcea78f6",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs_cache.c",
            "fs/smb/server/vfs_cache.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: track the connection owning a byte-range lock\n\nSMB2_LOCK adds each granted byte-range lock to both the file lock list\nand the lock list of the connection which handled the request.  The\nfinal close and durable handle paths, however, remove the connection\nlist entry while holding fp-\u003econn-\u003ellist_lock.\n\nWith SMB3 multichannel, the connection handling the LOCK request can be\ndifferent from the connection which opened the file.  The entry can\ntherefore be removed under a different spinlock from the one protecting\nthe list it belongs to.  A concurrent traversal can then access freed\nstruct ksmbd_lock and struct file_lock objects.\n\nRecord the connection owning each lock\u0027s clist entry and hold a\nreference to it while the entry is linked.  Use that connection and its\nllist_lock for unlock, rollback, close, and durable preserve.  Durable\nreconnect assigns the new connection as the owner when publishing the\nlocks again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An attacker reaches smb2_lock through remotely supplied SMB2 requests handled by ksmbd over TCP port 445.\nAC:L - In a multichannel deployment, the attacker controls the channels, lock creation, concurrent traversal, connection teardown, and close operations needed to trigger the lifetime violation.\nPR:L - The path requires a valid non-guest SMB3 session, signed multichannel binding, authorized tree connection, and an accessible file handle. An ordinary authenticated share user suffices; no administrative privilege is required.\nUI:N - The authenticated attacker can open, lock, traverse, and close the file or disconnect a channel without any victim action.\nS:U - The memory corruption compromises the ksmbd host kernel within the same security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - Freed ksmbd_lock and file_lock objects can be reclaimed and subsequently dereferenced during connection lock-list traversal, supporting disclosure of arbitrary kernel memory during exploitation.\nI:H - Stale list_del operations write through freed or attacker-influenced list pointers, providing exploitable heap corruption that can plausibly yield arbitrary writes and kernel code execution.\nA:H - The use-after-free and corrupted linked lists can cause kernel oopses, panics, or hangs, and the remote attacker can repeatedly retrigger the condition."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:41:27.278Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be"
        },
        {
          "url": "https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78"
        },
        {
          "url": "https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb"
        }
      ],
      "title": "ksmbd: track the connection owning a byte-range lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64390",
    "datePublished": "2026-07-25T08:50:37.406Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-05T12:41:27.278Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64390",
      "date": "2026-08-09",
      "epss": "0.00467",
      "percentile": "0.38086"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:50:58.000Z",
      "cve": "CVE-2026-64390",
      "id": "msrc_CVE-2026-64390",
      "initial_release_date": "2026-07-26T01:08:51.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: track the connection owning a byte-range lock",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64390.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64390\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:22.330\",\"lastModified\":\"2026-07-27T05:16:45.810\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: track the connection owning a byte-range lock\\n\\nSMB2_LOCK adds each granted byte-range lock to both the file lock list\\nand the lock list of the connection which handled the request.  The\\nfinal close and durable handle paths, however, remove the connection\\nlist entry while holding fp-\u003econn-\u003ellist_lock.\\n\\nWith SMB3 multichannel, the connection handling the LOCK request can be\\ndifferent from the connection which opened the file.  The entry can\\ntherefore be removed under a different spinlock from the one protecting\\nthe list it belongs to.  A concurrent traversal can then access freed\\nstruct ksmbd_lock and struct file_lock objects.\\n\\nRecord the connection owning each lock\u0027s clist entry and hold a\\nreference to it while the entry is linked.  Use that connection and its\\nllist_lock for unlock, rollback, close, and durable preserve.  Durable\\nreconnect assigns the new connection as the owner when publishing the\\nlocks again.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\",\"fs/smb/server/vfs_cache.c\",\"fs/smb/server/vfs_cache.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"22d38cf75b556c20b039743bdf3654d535b858be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"66eb3643164e5e1029907793926c132f8b5c6148\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"ea5c9bf99f626a15cc59f645dc895f2b3f01992e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"fe20d492a69a6f79e637f438072b212e21ed3b78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"427faaa52b0b399940c1a88065a5c310d10dad15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"5fecc15a30cb9ebd310f7b52c1ab607edcea78f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5a544e3bab78142207e0242d22442db85ba1eff\",\"lessThan\":\"c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\",\"fs/smb/server/vfs_cache.c\",\"fs/smb/server/vfs_cache.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-30T05:05:05+00:00",
      "cve": "CVE-2026-64390",
      "id": "CVE-2026-64390",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: track the connection owning a byte-range lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64390.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.