Look up another CVE · open CVE-2026-64016 in the interactive tracker
CVE-2026-64016
ksmbd: fix durable reconnect error path file lifetime
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64016 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/server/smb2pdu.c
- What this is
- KERNEL SMB3 SERVER (KSMBD)MAINTAINERS section matched on fs/smb/server/ · linux-cifs@vger.kernel.org · Maintained
- Kernel module
- ksmbd
Check it on the machine
grep -wE 'CONFIG_SMBFS|CONFIG_SMB_SERVER' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ksmbdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_SMBFS, CONFIG_SMB_SERVER
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.67%, higher than 51.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.6.157 | 6.6.157 | 5e641e4ee0bc |
| 6.12.110 | 6.12.110 | 478bfaa036bd |
| 6.18.33 | 6.18.34 | a1a39f227c80 |
| 7.0.10 | 7.0.11 | 6cb0b9385320 |
| 7.1 | 7.1 | 3515503322f4 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerability is reached through ksmbd's in-kernel SMB2 server on TCP port 445 via SMB2_CREATE durable-handle reconnect processing in smb2_open(), reachable by any remote SMB client that can connect to the server.
- AC:LAttack complexity, low
- An authenticated attacker can fully control the durable reconnect sequence (open with durable handle, disconnect to preserve it, reconnect, then force a post-reconnect error such as ksmbd_iov_pin_rsp() ENOMEM) and immediately exercise the stale volatile file ID via further SMB2 operations.
- PR:NPrivileges required, none
- Exploitation requires only network reachability to ksmbd and valid SMB session credentials (guest or any share user); no elevated kernel privileges, capabilities, or local access are needed beyond what any remote SMB client possesses.
- UI:NUser interaction, none
- No victim user interaction is required beyond the server running ksmbd with durable handles enabled; the attacker drives the entire reconnect-and-error sequence over the network.
- S:UScope, unchanged
- The use-after-free corrupts kernel heap memory within the ksmbd server context and can lead to privilege escalation on the host, but does not cross a VM, container, or IOMMU security boundary.
- C:HConfidentiality impact, high
- Freeing the ksmbd_file while its volatile ID remains in the session IDR creates a use-after-free; subsequent ksmbd_lookup_fd_slow() dereferences freed slab memory, enabling kernel information disclosure.
- I:HIntegrity impact, high
- The UAF corrupts kernel heap objects (struct ksmbd_file in the filp kmem cache) and can be leveraged with heap grooming for arbitrary kernel memory writes or code execution.
- A:HAvailability impact, high
- Use-after-free of the ksmbd_file object can cause kernel oopses or panics when freed memory is reused or dereferenced during subsequent SMB2 file operations on the stale volatile ID.