CVE-2026-64437: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64437 Overview

CVE-2026-64437 is a use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw occurs when an SMB2_CLOSE operation on a locking handle is followed by an SMB2_CANCEL for the same AsyncId. The smb2_lock() worker frees the associated file_lock structure but leaves the work on conn->async_requests with a live cancel_fn pointer, which the subsequent SMB2_CANCEL invokes over freed memory.

An authenticated SMB client can trigger the condition remotely against a vulnerable ksmbd server, leading to memory corruption and potential code execution in kernel context.

Critical Impact
An authenticated remote attacker can trigger a kernel use-after-free in ksmbd, enabling denial of service or potential kernel-level code execution.

Affected Products

Linux kernel with ksmbd enabled (SMB3 server)
Mainline kernel 7.1-rc7 (reproduced with KASAN)
Stable kernel branches receiving backported commit f580d27e8928

Discovery Timeline

2026-07-25 - CVE-2026-64437 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64437

Vulnerability Analysis

The vulnerability resides in ksmbd's handling of deferred file locks, specifically in the interaction between smb2_cancel(), smb2_lock(), and set_close_state_blocked_works(). A prior patch (f580d27e8928) added a guard that caused smb2_cancel() to skip work in the KSMBD_WORK_CANCELLED state so that its cancel_fn could not fire twice.

However, KSMBD_WORK has three terminal states: ACTIVE, CANCELLED, and CLOSED. The guard failed to cover the CLOSED case. When SMB2_CLOSE marks the deferred work as KSMBD_WORK_CLOSED, the smb2_lock() worker takes a non-ACTIVE early-exit path, calls locks_free_lock() on the file_lock, and follows the STATUS_RANGE_NOT_LOCKED branch with goto out2, skipping release_async_work(). The work remains queued with a cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock.

Root Cause

The root cause is an incomplete state check in smb2_cancel(). Only work in the ACTIVE state should have its cancel_fn invoked, but the existing guard only excluded CANCELLED work. Both CLOSED and CANCELLED reach the freeing early-exit in smb2_lock(), so both must be treated as non-cancellable. This is a use-after-free flaw in the file_lock_cache slab (object size 192), classified as [CWE-416].

Attack Vector

An authenticated SMB client issues a lock request that creates a deferred file_lock. The client then sends SMB2_CLOSE on the locking handle, followed by SMB2_CANCEL targeting the same AsyncId. The stale cancel_fn fires against the freed file_lock, producing a KASAN slab-use-after-free splat in __locks_delete_block via ksmbd_vfs_posix_lock_unblock and smb2_remove_blocked_lock. Exploitation requires network reachability to the ksmbd service and valid SMB credentials.

See the upstream fix in the kernel commit series for the corrected state check.

Detection Methods for CVE-2026-64437

Indicators of Compromise

KASAN reports of slab-use-after-free in __locks_delete_block referencing the file_lock_cache slab.
Kernel oops or panic traces containing smb2_remove_blocked_lock, smb2_cancel, and handle_ksmbd_work frames.
Unexpected ksmbd worker crashes correlated with SMB2_CLOSE followed by SMB2_CANCEL from the same client session.

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during fuzzing or red-team exercises against ksmbd.
Monitor SMB traffic for authenticated clients issuing SMB2_CLOSE immediately followed by SMB2_CANCEL against the same AsyncId on locking handles.
Alert on repeated ksmbd worker restarts or kernel log entries mentioning ksmbd and file_lock.

Monitoring Recommendations

Forward dmesg and journald kernel logs from SMB file servers to a centralized log platform and alert on KASAN or slab-corruption strings.
Track authenticated SMB sessions producing anomalous lock/cancel patterns and correlate with source IPs and user accounts.
Baseline normal ksmbd worker lifecycle events to detect deviations indicative of exploitation attempts.

How to Mitigate CVE-2026-64437

Immediate Actions Required

Apply the upstream ksmbd fix that guards on KSMBD_WORK_ACTIVE so any non-active work is skipped by smb2_cancel().
Update to a stable kernel release that includes commits 10f293a, 12c36c9, 94083db, a796ba4, b8e274e, or ddb9239 as appropriate for your branch.
Restrict SMB service exposure to trusted network segments and authenticated users only.

Patch Information

The fix is available across multiple stable kernel branches. Reference commits include 10f293a, 12c36c9, 94083db, a796ba4, b8e274e, and ddb9239. Rebuild and reboot into the patched kernel to eliminate the flaw.

Workarounds

Disable the ksmbd module on hosts that do not require it and use an alternative SMB server such as Samba smbd in userspace.
Enforce firewall rules limiting inbound TCP 445 to a strict allowlist of management hosts.
Require strong authentication and disable guest or anonymous SMB access to reduce the attacker population.

bash

# Configuration example: disable ksmbd and block SMB at the host firewall
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
sudo iptables -A INPUT -p tcp --dport 445 -j DROP