CVE-2026-64437

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on

double SMB2_CANCEL") made smb2_cancel() skip a work whose state is

KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But

KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same

freeing producer path is reached for CLOSED too:

SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets

the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()

worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s

the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes

the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the

cancelled branch, skips release_async_work(). The work stays on

conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock

poi

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References