CVE-2026-64136
In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().
Affected versions
Linux kernel versions
6.6.128,
6.12.75,
6.18.16,
6.19.6,
7.0
and later are affected. Fixed in
6.6.142,
6.12.92,
6.18.34,
7.0.11,
7.1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-64136?
CVE-2026-64136 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.6.128 onward and has been patched in 6.6.142, 6.12.92, 6.18.34 and others. CVE-2026-64136 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64136?
Yes — CVE-2026-64136 has been patched. Fixed versions include 6.6.142, 6.12.92, 6.18.34 and others. If you are running Linux kernel 6.6.128 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64136 actively exploited?
No — CVE-2026-64136 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.