CVE-2026-64136 Overview
CVE-2026-64136 is a Linux kernel vulnerability in the SMB client code. The flaw exists in smb2_find_smb_sess_tcon_unlocked(), where an increment of the tc_count field occurs without the required lock. A previous refactor introduced by commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") replaced cifs_tcp_ses_lock with tc_lock for tc_count accesses but missed this specific code path. The unprotected reference counter update creates a race condition on the tcon (tree connection) object used by the CIFS/SMB client.
Critical Impact
Concurrent SMB client operations can corrupt the tc_count reference counter, leading to memory safety issues in the Linux kernel.
Affected Products
- Linux kernel versions containing commit 96c4af418586 prior to the fix
- Systems using the in-kernel CIFS/SMB client (cifs.ko)
- Distributions shipping affected stable kernel branches
Discovery Timeline
- 2026-07-19 - CVE-2026-64136 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64136
Vulnerability Analysis
The vulnerability resides in the Linux kernel SMB client at fs/smb/client/smb2misc.c, within smb2_find_smb_sess_tcon_unlocked(). This function iterates over tree connections associated with an SMB session and increments the tc_count reference counter on a matched struct cifs_tcon. Reference counter operations on shared kernel objects must occur under an appropriate lock to prevent concurrent modification. The missing tc_lock around the increment allows two kernel threads to update tc_count simultaneously, producing lost updates or use-after-free conditions when the counter falls out of sync with actual references.
Root Cause
Commit 96c4af418586 migrated tc_count protection from the broader cifs_tcp_ses_lock to the finer-grained per-tcon tc_lock. The refactor did not convert every write site. The increment inside smb2_find_smb_sess_tcon_unlocked() remained unprotected, breaking the invariant that all tc_count modifications occur under tc_lock.
Attack Vector
The attack vector is local to any process able to trigger concurrent SMB client operations against the same mount, such as parallel file access on a mounted CIFS/SMB share. A local attacker who can force the kernel to look up the same tcon from multiple threads can induce the race. The consequence is memory corruption in kernel space, which may be leveraged for privilege escalation or denial of service. See the Linux kernel fix commit 7df1df6 for the code change.
Detection Methods for CVE-2026-64136
Indicators of Compromise
- Kernel oops or panic messages referencing cifs_put_tcon, tconInfoFree, or smb2_find_smb_sess_tcon_unlocked
- Unexpected refcount_t warnings such as refcount_t: underflow or saturation in dmesg
- Sporadic use-after-free KASAN reports in the cifs/smb client module
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_REFCOUNT_FULL on test systems to surface races on tc_count
- Audit loaded kernel version against the fix commits listed in the NVD references
- Correlate CIFS mount activity with kernel ring buffer anomalies collected by log forwarders
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized log store for kernel fault analysis
- Alert on kernel module crashes in cifs.ko across the fleet
- Track SMB mount workloads on multi-threaded workstations and servers where the race is more likely to trigger
How to Mitigate CVE-2026-64136
Immediate Actions Required
- Inventory Linux hosts running kernels between the introduction of commit 96c4af418586 and the fix commits
- Apply the vendor-provided stable kernel update that includes the missing tc_lock around the tc_count increment
- Reboot systems after patching to load the corrected cifs.ko module
Patch Information
The fix adds the missing tc_lock around the tc_count increment inside smb2_find_smb_sess_tcon_unlocked(). The change is available in the following stable kernel commits: 13fb413, 4d8690d, 7df1df6, bf4ebdb, and e374f4e. Consume the fix through your distribution's kernel package update channel.
Workarounds
- Unmount CIFS/SMB shares on affected hosts until the patched kernel is deployed
- Disable automatic loading of the cifs module via /etc/modprobe.d/ on systems that do not require SMB client functionality
- Restrict local user access on hosts where CIFS mounts must remain active to reduce race triggering opportunities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
