CVE-2026-64142 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and ensure that their systems are updated with the latest kernel patches. Additionally, security teams and vulnerability management teams should review the affected scope and severity of the vulnerability and plan for mitigation or remediation.

Technical summary

The ksmbd_durable_scavenger function in the Linux kernel had two related races against any walker that iterates f_ci->m_fp_list. The first race involved reusing fp->node as a scavenger-private list node, which could corrupt both lists. The second race was a refcount issue against m_fp_list walkers, which could lead to use-after-free. The vulnerability was fixed by stopping the reuse of fp->node, taking an explicit transient reference, and clearing fp->persistent_id. The changes ensure that durable-preserved handles are properly removed from the global durable idr and that the scavenger does not corrupt the m_fp_list.

Defensive priority

High

Recommended defensive actions

• Apply the latest Linux kernel patches to ensure that the vulnerability is fixed.
• Review and update Linux kernel configurations to prevent similar issues.
• Monitor Linux kernel updates and security advisories for potential vulnerabilities.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was discovered and resolved by modifying the ksmbd_durable_scavenger function. The fix involves stopping the reuse of fp->node, taking an explicit transient reference, and clearing fp->persistent_id. The vulnerability was verified using CONFIG_DEBUG_LIST coverage and KASAN-enabled direct SMB2 durable-handle coverage. The changes ensure that durable-preserved handles are properly removed from the global durable idr and that the scavenger does not corrupt the m_fp_list.

Official resources