CVE-2026-64396 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should verify and apply patches, monitor system logs, and update kernel versions to prevent potential exploitation of this use-after-free vulnerability in the Linux kernel's ksmbd module.

Why it matters

A use-after-free vulnerability in the Linux kernel's ksmbd module requires patching to prevent potential exploitation. Linux kernel developers, maintainers, and users should verify and apply patches, monitor system logs, and update kernel versions.

• Verify and apply patches to prevent potential use-after-free exploitation
• Monitor system logs for potential exploitation attempts
• Update Linux kernel versions to patched versions

Technical summary

The vulnerability exists in the Linux kernel's ksmbd module, specifically in the SMB2_LOCK deferred-lock cancellation. A use-after-free issue can occur when a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path. The fix involves restructuring the cleanup logic after the worker returns from ksmbd_vfs_posix_lock_wait() to prevent the use-after-free issue. This includes moving list_del(&smb_lock->llist) and release_async_work(work) to the top of the cleanup block, ensuring that the async work is completely dequeued and serialized under conn->request_lock before locks_free_lock(flock) is called.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel version is updated to a patched version
• Monitor system logs for potential exploitation attempts
• Verify affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced in the Linux kernel and affects various versions. The issue arises when a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path. The fix involves restructuring the cleanup logic after the worker returns from ksmbd_vfs_posix_lock_wait().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.