CVE-2026-64142: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64142 Overview

CVE-2026-64142 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in ksmbd_durable_scavenger(), which contains two related race conditions against walkers that iterate f_ci->m_fp_list, including ksmbd_lookup_fd_inode() used by ksmbd_vfs_rename and share-mode checks in fs/smb/server/smb_common.c. The scavenger reuses fp->node as a private list node and drops locks before unlinking freed handles, corrupting list state and creating a deterministic UAF window. Remote attackers on the network can trigger the race through concurrent SMB2 durable handle operations and rename lookups.

Critical Impact
Remote unauthenticated attackers can exploit list corruption and use-after-free conditions in ksmbd to achieve kernel memory corruption, potentially leading to remote code execution in kernel context.

Affected Products

Linux kernel with ksmbd (in-kernel SMB3 server) enabled
Systems exposing SMB shares that permit durable handle reconnect
Multiple stable kernel branches (see referenced git commits)

Discovery Timeline

2026-07-19 - CVE CVE-2026-64142 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64142

Vulnerability Analysis

The vulnerability spans two intertwined race conditions in the ksmbd durable scavenger path. Durable-preserved handles remain linked on f_ci->m_fp_list after session teardown so share-mode checks can still observe them while the handle is reconnectable. The scavenger collects expired handles by removing them from the global durable IDR and processing them for release, but its handling of both list membership and refcount lifecycle is unsafe under concurrent access.

A network-adjacent attacker who can interact with SMB shares served by ksmbd can drive concurrent operations that force the scavenger and the m_fp_list walkers to race. Successful exploitation yields kernel heap corruption or use-after-free primitives, exposing confidentiality, integrity, and availability of the target host.

Root Cause

Two defects combine to produce the flaw. First, the scavenger reuses fp->node, the same list_head used for m_fp_list membership, to link the handle onto a private scavenger_list. The list_add(&fp->node, &scavenger_list) call overwrites the m_fp_list links and corrupts both lists, a condition CONFIG_DEBUG_LIST can flag during share-mode walks.

Second, the scavenger qualifies an expired handle with atomic_read(&fp->refcount) > 1 under global_ft.lock, removes fp from global_ft, then releases the lock before unlinking fp from m_fp_list and freeing it. During that gap fp remains linked with f_state == FP_INITED. A concurrent ksmbd_lookup_fd_inode() calling ksmbd_fp_get() with atomic_inc_not_zero acquires a live reference, and the subsequent free produces a UAF on the holder's ksmbd_fd_put() and on share-mode walkers that iterate m_fp_list without taking a reference.

Attack Vector

Exploitation requires reachable SMB service and the ability to open durable handles and issue operations such as rename against the same inode. An attacker triggers durable handle expiration while concurrently invoking rename or share-mode lookup paths, causing the scavenger to unlink and free file pointer objects that other paths still reference. The vulnerability is exploitable over the network without prior authentication in configurations that permit guest or unauthenticated SMB access. Refer to the referenced Kernel Git Commit Fix for the authoritative patch context.

Detection Methods for CVE-2026-64142

Indicators of Compromise

Kernel log entries from CONFIG_DEBUG_LIST reporting list corruption on m_fp_list walk paths inside fs/smb/server/.
KASAN reports identifying use-after-free in ksmbd_fp_get, ksmbd_fd_put, or ksmbd_lookup_fd_inode.
Unexpected ksmbd.mountd or worker crashes coinciding with heavy SMB durable handle reconnect activity.

Detection Strategies

Enable CONFIG_DEBUG_LIST and KASAN on test systems mirroring production to surface corruption during SMB stress testing.
Monitor kernel ring buffer via dmesg and forward to a central log store for regex matching on ksmbd, list_add corruption, and BUG: KASAN signatures.
Correlate SMB2 CREATE requests with durable-handle flags against subsequent rename or close operations to identify anomalous session patterns.

Monitoring Recommendations

Track kernel crash frequency on hosts running ksmbd and alert on any oops or panic referencing smb/server symbols.
Capture SMB traffic metadata at network egress points and baseline durable handle churn against normal client behavior.
Instrument audit rules for insmod/modprobe events touching the ksmbd module to detect unexpected reloads or reinitialization.

How to Mitigate CVE-2026-64142

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all systems running ksmbd.
Disable the ksmbd module on hosts that do not require in-kernel SMB serving using rmmod ksmbd and blacklist it via /etc/modprobe.d/.
Restrict SMB exposure to trusted network segments and require authenticated access on all shares.

Patch Information

The fix stops reusing fp->node as a scavenger-private list node, introduces a transient reference so the walker or the scavenger safely owns the final close, clears fp->persistent_id inside __ksmbd_remove_durable_fd() immediately after idr_remove(), and bypasses the per-conn open_files_count decrement in __put_fd_final() when fp->conn has been cleared. The corrective commits are available at Kernel Git Commit Fix, Kernel Git Commit Change, Kernel Git Commit Update, Kernel Git Commit Patch, and Kernel Git Commit Enhancement. Consult your distribution's security tracker for the specific packaged kernel build.

Workarounds

Substitute ksmbd with the userspace Samba server until patched kernels are deployed to reduce exposure to the in-kernel race.
Firewall SMB ports 445/TCP and 139/TCP to trusted management networks only, blocking untrusted client reachability to the vulnerable service.
Disable durable handle support in share configuration where operationally acceptable to shrink the vulnerable code path exercised by clients.

bash

# Configuration example - disable and blacklist the ksmbd module
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB access at the host firewall (nftables example)
sudo nft add rule inet filter input tcp dport {139, 445} ip saddr != 10.0.0.0/8 drop