{"id":"CVE-2026-64396","summary":"ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation\n\nWhen a blocking byte-range lock request is deferred in the\nFILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into\nthe connection's async_requests list via setup_async_work(). The cancel\ncallback smb2_remove_blocked_lock() holds a reference to the flock.\n\nIf the lock waiter is subsequently woken up but the work state is no\nlonger KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the\ncleanup path calls locks_free_lock(flock) without dequeuing the work from\nthe async_requests list. Concurrently, smb2_cancel() walks the list\nunder conn-\u003erequest_lock and invokes the cancel callback, which then\ndereferences the already freed 'flock'. This leads to a slab-use-after-free\ninside __wake_up_common.\n\nFix this by restructuring the cleanup logic after the worker returns\nfrom ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock-\u003ellist) and\nrelease_async_work(work) to the top of the cleanup block. This guarantees\nthat the async work is completely dequeued and serialized under\nconn-\u003erequest_lock before locks_free_lock(flock) is called, rendering\nthe flock unreachable for any concurrent smb2_cancel().","modified":"2026-07-28T04:02:47.847953815Z","published":"2026-07-25T08:50:40.993Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64396.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64396.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64396"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9"},{"fixed":"367c42a611fe488b7b03f1f6737f4dee0e8b20a2"},{"fixed":"7703fd9aba1f2483c8e55f9ff73b7663e0761ed9"},{"fixed":"463bbd79698513af4dad50fe1c573825f297ca2e"},{"fixed":"5aa1cb01155f96824003baf7997cdf1f150caba3"},{"fixed":"5c75275c0fc9a2deb0d8f5604edcb16f288171c8"},{"fixed":"d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64396.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.15.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64396.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}