CVE-2026-64390: Linux Kernel Race Condition Vulnerability

CVE-2026-64390 Overview

CVE-2026-64390 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw resides in the byte-range lock tracking logic used by SMB2_LOCK request handling. When SMB3 multichannel is in use, the connection processing a lock request can differ from the connection that opened the file. This mismatch causes list entries to be removed under a different spinlock than the one protecting the list, allowing concurrent traversal to access freed struct ksmbd_lock and struct file_lock objects.

Critical Impact
An authenticated remote SMB client can trigger memory corruption in the kernel through concurrent lock and close operations across multichannel connections, potentially leading to kernel code execution or denial of service.

Affected Products

Linux kernel with ksmbd (in-kernel SMB3 server) compiled and enabled
Systems exposing SMB3 with multichannel support
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64390 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64390

Vulnerability Analysis

The ksmbd server processes SMB2_LOCK requests by adding each granted byte-range lock to two lists. The first is the file lock list. The second is the lock list belonging to the connection that handled the request. Cleanup paths, including final close and durable handle logic, remove the connection list entry while holding fp->conn->llist_lock.

With SMB3 multichannel, a single session can span multiple TCP connections. The connection handling a LOCK request may not be the connection that originally opened the file. As a result, the cleanup path takes fp->conn->llist_lock, but the list entry actually belongs to a different connection's llist. A concurrent traversal on that other connection can then dereference freed struct ksmbd_lock and struct file_lock memory.

Root Cause

The root cause is a locking scope mismatch. The code assumed the file's owning connection also owned every lock entry, which does not hold under multichannel. The fix records the connection that owns each lock's clist entry and holds a reference to it while linked. Unlock, rollback, close, and durable preserve paths now use that owning connection's llist_lock. Durable reconnect assigns the new connection as the owner when republishing locks.

Attack Vector

Exploitation requires an authenticated SMB session against a ksmbd share with multichannel negotiated. An attacker issues concurrent SMB2_LOCK operations across multiple channels and races them against close or durable handle teardown. Winning the race yields use-after-free access to kernel lock structures. See the upstream fix commits, including Kernel Patch 22d38cf75, for technical details.

Detection Methods for CVE-2026-64390

Indicators of Compromise

Kernel oops or KASAN use-after-free reports referencing ksmbd_lock, file_lock, or ksmbd_vfs_posix_lock call paths
Unexpected ksmbd worker thread crashes or kernel panics on hosts serving SMB3 multichannel clients
SMB clients repeatedly establishing multiple channels followed by rapid lock and close sequences from the same session

Detection Strategies

Monitor dmesg and journalctl -k for ksmbd faults, list corruption warnings, and slab use-after-free traces
Alert on abnormal volumes of SMB2_LOCK requests correlated with close or session teardown from the same client
Track ksmbd service restarts and kernel taint flags on file servers exposing SMB shares

Monitoring Recommendations

Enable KASAN and lockdep on test kernels to surface latent misuse during pre-production validation
Forward kernel logs from SMB servers to a centralized logging pipeline for correlation and retention
Inventory Linux hosts that load the ksmbd module and record whether SMB3 multichannel is enabled

How to Mitigate CVE-2026-64390

Immediate Actions Required

Apply the stable kernel updates containing the ksmbd byte-range lock ownership fix as soon as vendor packages are available
Restrict network access to ksmbd shares to trusted clients using firewall rules on TCP 445
Disable ksmbd on systems that do not require an in-kernel SMB server and use user-space Samba instead

Patch Information

The fix is available across multiple stable kernel branches. Refer to the upstream commits: Kernel Patch 22d38cf75, Kernel Patch 427faaa52b, Kernel Patch 5fecc15a30, Kernel Patch 66eb364316, Kernel Patch c1016dd1d8, Kernel Patch ea5c9bf99f, and Kernel Patch fe20d492a6. Rebuild or install distribution kernels that incorporate these commits and reboot affected hosts.

Workarounds

Disable SMB3 multichannel on the server side to prevent the cross-connection race that triggers the flaw
Unload the ksmbd module on hosts that do not need in-kernel SMB service until patched kernels are deployed
Limit share access to authenticated, trusted user accounts to reduce the pool of potential attackers

bash

# Disable and unload ksmbd until a patched kernel is installed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Block external SMB access at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -j DROP