CVE-2026-64016: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64016 Overview

CVE-2026-64016 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the durable file handle reconnect error path within smb2_open(). When a durable reconnect succeeds and ksmbd_reopen_durable_fd() republishes a ksmbd_file into the session volatile-id table, a subsequent error path performs two puts on the same file object. The final durable put calls __ksmbd_close_fd(NULL, fp), which is not session-aware and can free the file while its volatile-id entry remains in the session table. Remote SMB clients can trigger the condition over the network without authentication.

Critical Impact
Remote unauthenticated attackers can trigger memory corruption in the Linux kernel SMB server, leading to arbitrary code execution, denial of service, or information disclosure.

Affected Products

Linux kernel builds shipping the ksmbd in-kernel SMB3 server prior to the fix commits
Linux distributions exposing ksmbd as a file sharing service
SMB3 deployments using durable file handles for client reconnect resilience

Discovery Timeline

2026-07-19 - CVE-2026-64016 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64016

Vulnerability Analysis

The flaw is a use-after-free in the ksmbd durable reconnect cleanup path. After ksmbd_reopen_durable_fd() succeeds, the same ksmbd_file pointer is stored both as fp and as dh_info.fp. When smb2_open() subsequently hits an error path, the cleanup logic executes ksmbd_fd_put(work, fp) followed unconditionally by ksmbd_put_durable_fd(dh_info.fp).

Both calls operate on the same file object. The first put releases the reconnect lookup reference. The second put invokes the final close through __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it frees the ksmbd_file without removing the volatile-id entry that was just published into the session volatile-id table. Any later access via that dangling volatile-id reads or writes freed kernel memory.

Root Cause

The root cause is inconsistent reference lifetime management between the session volatile-id table and the durable file handle table. The error path used a non-session-aware close primitive to release a file that had already been re-registered into the session. This left a dangling table entry referencing freed memory, producing a classic use-after-free.

Attack Vector

The vulnerability is reachable over the network by any SMB client capable of establishing an SMB3 session and requesting a durable file handle. An attacker forces the reconnect flow to succeed and then induces an error path in smb2_open(), causing the double-put sequence. No user interaction is required. Successful exploitation yields kernel-level impact on confidentiality, integrity, and availability.

The upstream fix, distributed across kernel commits 3515503, 6cb0b93, and a1a39f2, switches the final reconnect drop to the session-aware put when the reconnect had already succeeded. Earlier reconnect failures, before fp is assigned to dh_info.fp, continue to use the durable-only put path.

Detection Methods for CVE-2026-64016

Indicators of Compromise

Kernel oops, general protection fault, or KASAN use-after-free reports referencing ksmbd_fd_put, ksmbd_put_durable_fd, or __ksmbd_close_fd in stack traces
Unexpected ksmbd worker crashes or SMB session terminations coinciding with client reconnect activity
SMB clients repeatedly issuing durable handle reconnects followed by malformed SMB2 CREATE requests

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access patterns in ksmbd during fuzzing or SMB protocol testing
Monitor kernel ring buffer and journal logs for ksmbd fault signatures and correlate with source IPs of active SMB sessions
Inspect network telemetry for anomalous SMB2 CREATE volumes and repeated durable handle reconnect sequences from a single client

Monitoring Recommendations

Alert on Linux hosts running ksmbd where the running kernel version predates commits 3515503, 6cb0b93, or a1a39f2
Track SMB service availability and process restarts on file servers exposing ksmbd to untrusted networks
Capture PCAPs on SMB-exposed hosts to enable post-incident reconstruction of malicious durable reconnect flows

How to Mitigate CVE-2026-64016

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 3515503322f4, 6cb0b9385320, and a1a39f227c80 as soon as vendor builds are available
Restrict network access to TCP port 445 on ksmbd hosts using host firewalls or network segmentation until patched
Disable ksmbd on systems that do not require in-kernel SMB serving and use Samba userspace as an interim alternative
Require SMB signing and authenticated sessions to reduce exposure from unauthenticated network peers

Patch Information

The fix updates the durable reconnect error path in smb2_open() to use the session-aware put for the final drop when the reconnect had already succeeded. Reference the upstream commits: Kernel Git Commit 3515503, Kernel Git Commit 6cb0b93, and Kernel Git Commit a1a39f2. Track your distribution's stable kernel updates for backports.

Workarounds

Unload the ksmbd module (modprobe -r ksmbd) on hosts that do not require it
Block inbound SMB (TCP 445, 139) from untrusted networks at the perimeter and host firewall
Migrate temporarily to Samba userspace SMB server, which is not affected by this specific ksmbd code path

bash

# Disable ksmbd until patched kernels are deployed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Block SMB at the host firewall (nftables example)
sudo nft add rule inet filter input tcp dport {139,445} drop