CVE-2026-64016ksmbd: fix durable reconnect error path file lifetime
- 9.8CriticalCVSS base score
- 0.67%Exploitation in 30 daysEPSS · top 47% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path.
Timeline
ID reserved
By Linux
Published
- 57 days later
· 57 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.67% · top 47% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected f0ff7f12398e85b3a11745ff7feab6246f3d75c2 – < 5e641e4ee0bc1937408d41051a908ad4151be63b
- affected 4db3dcac84c2f14a45ae201efb38de1fb1bfc009 – < 478bfaa036bd0c7e179acff8b8484bccdee3b8c7
- affected ce2e164c1c51c3f7813b80f8c926836e896bcbb3 – < a1a39f227c80cbf369767badc32cba2b225147d1
- affected 97a0cd55283b4e63fd92804da91c8d9896adcad9 – < 6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3
- affected 1baff47b81f94f9231c91236aa511420d0e266b9 – < 3515503322f4819277091839eed46b695096aca5
- affected 6.18.33 – < 6.18.34
- affected 7.0.10 – < 7.0.11
References
References5
- https://git.kernel.org/stable/c/5e641e4ee0bc1937408d41051a908ad4151be63b (opens in a new tab)
- https://git.kernel.org/stable/c/478bfaa036bd0c7e179acff8b8484bccdee3b8c7 (opens in a new tab)
- https://git.kernel.org/stable/c/a1a39f227c80cbf369767badc32cba2b225147d1 (opens in a new tab)
- https://git.kernel.org/stable/c/6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3 (opens in a new tab)
- https://git.kernel.org/stable/c/3515503322f4819277091839eed46b695096aca5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-45589 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64016)Record last updated .