CVE-2026-64142

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: close durable scavenger races against m_fp_list lookups

ksmbd_durable_scavenger() has two related races against any walker

that iterates f_ci->m_fp_list, including ksmbd_lookup_fd_inode()

(used by ksmbd_vfs_rename) and the share-mode checks in

fs/smb/server/smb_common.c.

(1) fp->node list-head reuse. Durable-preserved handles can remain

linked on f_ci->m_fp_list after session teardown so share-mode checks

still see them while the handle is reconnectable. The scavenger

collected expired handles by adding fp->node to a local

scavenger_list after removing them from the global durable idr.

Because fp->node is the same list_head used by m_fp_list,

list_add(&fp->node, &scavenger_list) overwrites the m_fp_list links

and corrupts both lists. CONFIG_DEBUG_LIST can report this on the

share-mode walk path.

(2) Refcount race against m_fp_list walkers. The scavenger qualifies

an expired durable handle with atomic_rea

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References