CVE-2026-64390
In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichannel, the connection handling the LOCK request can be different from the connection which opened the file. The entry can therefore be removed under a different spinlock from the one protecting the list it belongs to. A concurrent traversal can then access freed struct ksmbd_lock and struct file_lock objects. Record the connection owning each lock's clist entry and hold a reference to it while the entry is linked. Use that connection and its llist_lock for unlock, rollback, close, and durable preserve. Durable reconnect assigns the new connection as the owner when publishing the locks again.
Affected versions
Linux kernel versions
5.15
and later are affected. Fixed in
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.4,
7.2-rc1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-64390?
CVE-2026-64390 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.15 onward and has been patched in 5.15.212, 6.1.178, 6.6.145 and others. CVE-2026-64390 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64390?
Yes. CVE-2026-64390 has been patched. Fixed versions include 5.15.212, 6.1.178, 6.6.145 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64390 actively exploited?
No. CVE-2026-64390 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.