CVE-2026-64396 Overview
CVE-2026-64396 is a use-after-free (UAF) vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the SMB2_LOCK command handling path, specifically in the deferred-lock cancellation logic. When a blocking byte-range lock request is deferred via FILE_LOCK_DEFERRED, ksmbd registers asynchronous work but fails to serialize cleanup correctly. A concurrent smb2_cancel() can dereference a struct file_lock after it has been freed by locks_free_lock(), triggering a slab-use-after-free inside __wake_up_common.
Critical Impact
An authenticated remote attacker with SMB access can trigger a slab-use-after-free in the Linux kernel, potentially leading to kernel memory corruption, denial of service, or privilege escalation.
Affected Products
- Linux kernel with ksmbd (in-kernel SMB3 server) enabled
- Kernel builds prior to the fix commits listed in the stable tree
- Systems exposing SMB shares served by ksmbd
Discovery Timeline
- 2026-07-25 - CVE-2026-64396 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64396
Vulnerability Analysis
The vulnerability affects ksmbd's handling of blocking byte-range locks in SMB2. When a client requests a lock that cannot be granted immediately, ksmbd takes the FILE_LOCK_DEFERRED path and registers asynchronous work into the connection's async_requests list via setup_async_work(). The registered cancel callback, smb2_remove_blocked_lock(), holds a reference to the associated struct file_lock (flock).
A race condition arises when the lock waiter is woken while the work state is no longer KSMBD_WORK_ACTIVE, for example due to a concurrent cancellation. The cleanup path invokes locks_free_lock(flock) before dequeuing the async work from the async_requests list. Concurrently, smb2_cancel() walks that list under conn->request_lock and invokes the cancel callback, which dereferences the freed flock. The result is a slab-use-after-free observed inside __wake_up_common.
Root Cause
The root cause is incorrect ordering of cleanup operations after the worker returns from ksmbd_vfs_posix_lock_wait(). The struct file_lock is freed before the associated async work is removed from the connection-wide list, leaving a dangling reference reachable by another thread executing smb2_cancel() [Use After Free].
Attack Vector
Exploitation requires network access to an SMB share served by ksmbd and valid authentication. An attacker issues concurrent SMB2_LOCK requests with blocking byte-range semantics alongside SMB2_CANCEL operations to race the deferred-lock cleanup path against the cancellation callback. Successful races corrupt slab memory holding struct file_lock objects, which can be leveraged for denial of service or, with additional heap-grooming primitives, kernel-mode code execution. Refer to the upstream patch commits for the precise fix restructuring list_del(&smb_lock->llist) and release_async_work(work) ordering.
Detection Methods for CVE-2026-64396
Indicators of Compromise
- Kernel log entries containing KASAN: slab-use-after-free referencing __wake_up_common or smb2_remove_blocked_lock
- Unexpected ksmbd worker crashes or kernel oops messages tied to SMB2 lock handling
- Anomalous bursts of SMB2_LOCK and SMB2_CANCEL requests from a single client session
Detection Strategies
- Enable KASAN on test and staging kernels to surface the UAF condition during fuzzing or QA workloads
- Monitor kernel ring buffer (dmesg) for ksmbd-related warnings and use-after-free reports
- Correlate SMB session telemetry with kernel crash events to identify race-condition exploitation attempts
Monitoring Recommendations
- Aggregate dmesg, journalctl -k, and kernel crash dumps into a centralized logging pipeline for continuous review
- Alert on repeated ksmbd worker restarts or connection resets from the same source IP
- Track SMB protocol anomalies such as high-frequency lock/cancel sequences that deviate from baseline client behavior
How to Mitigate CVE-2026-64396
Immediate Actions Required
- Apply the upstream stable kernel patches referenced below and reboot affected hosts
- Restrict SMB access to trusted networks and authenticated users via firewall rules and share-level ACLs
- If ksmbd is not required, unload the module (modprobe -r ksmbd) and disable it at boot
Patch Information
The fix restructures the cleanup logic after the worker returns from ksmbd_vfs_posix_lock_wait(). It moves list_del(&smb_lock->llist) and release_async_work(work) to the top of the cleanup block, ensuring the async work is dequeued and serialized under conn->request_lock before locks_free_lock(flock) executes. Applicable stable-tree commits: Kernel Patch Commit 367c42a, Kernel Patch Commit 463bbd7, Kernel Patch Commit 5aa1cb0, Kernel Patch Commit 5c75275, Kernel Patch Commit 7703fd9, and Kernel Patch Commit d20d1c8.
Workarounds
- Disable ksmbd and migrate SMB workloads to a user-space server such as Samba until patched kernels are deployed
- Block inbound TCP/445 at the perimeter and internal segmentation points where ksmbd is exposed
- Enforce strict SMB authentication and remove guest or anonymous access to reduce the attack surface
# Configuration example: disable and blacklist ksmbd until patched
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
# Restrict SMB access at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
