CVE-2026-64016: Linux kernel ksmbd use-after-free in durable reconnect error path
A use-after-free flaw in the ksmbd SMB server of the Linux kernel can occur in the durable reconnect error path, when a republished file object is released with the wrong put routine. The record classifies it as CWE-416 with a CVSS base score of 9.8 and severity critical. Fix commits are listed for stable branches, and no confirmed exploitation appears in the sources consulted.
Overview
This record describes a flaw in the durable reconnect handling of the ksmbd in-kernel SMB server. After a durable reconnect succeeds, the same file object is published again into the session volatile-id table. If a later error path in the open handling runs, the cleanup releases the same object through two different put routines, and the final durable release does not remove the session table entry.
Impact
The record assigns CWE-416 (Use After Free). According to the description, the final release can free the file object while its volatile-id entry is still present in the session table. The CVSS base score given in the record is 9.8 with high confidentiality, integrity and availability impact and no privileges or user interaction required. The record does not describe a specific impact outcome beyond this classification and score.
Affected products and versions
The record lists the Linux kernel with affected ranges expressed as kernel commit ranges, plus two stable-branch ranges: from 6.18.33 up to and including before 6.18.34, and from 7.0.10 up to and including before 7.0.11. The second product entry lists 6.18.33, 7.0.10 and the release candidates 7.1-rc1, 7.1-rc2, 7.1-rc3 and 7.1-rc4 as affected.
Exploitation status
The CISA KEV catalog entry in the record is not listed. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.00671 with a percentile of 0.5147, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Apply the stable kernel updates referenced in the record, using the fix commits listed for the affected branches.
- For stable branches, the affected ranges indicate that 6.18.34 and 7.0.11 are the first versions after the affected stable ranges, which is an inference from the record.
- Verify which kernel build is running on each system and whether the ksmbd module is loaded.
- If ksmbd is not required, reducing its exposure is a reasonable defensive step; the record does not provide a workaround.
Detection guidance
- Inventory hosts that run the Linux kernel with ksmbd enabled and compare kernel builds against the affected ranges.
- Review kernel logs and crash reports from systems that serve SMB durable handles for unexpected memory faults or unusual reconnect activity.
- Keep monitoring vendor and distribution advisories for backported fixes that may use different version strings.
Limitations of the available information
The record does not state a fixed version for the 7.1 release candidates, and mainline fixed versions are only given as commit identifiers. The record does not describe the trigger conditions in operational detail, and this analysis does not provide any. Distribution-specific backports and exploit availability are not covered by the sources consulted.
Frequently asked questions
What is CVE-2026-64016?
It is a use-after-free flaw in the ksmbd SMB server of the Linux kernel, triggered in the durable reconnect error path according to the record.
Is this vulnerability known to be actively exploited?
The record shows no KEV listing, and no confirmed active exploitation appears in the sources consulted.
What should administrators do?
Compare kernel builds with the affected ranges, apply the stable updates referenced in the record, and reduce exposure of ksmbd if it is not needed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.