CVE Explorer

CVE-2026-64437

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too: SMB2_CLOSE

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:fb32d8977b1217051246ad4ef6e4f47ce373bb4cf9836b1e849f1b97d47f1280

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOr…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a796ba4e61d5e14e07b79a359faac69f8f9b22a3","status":"affected","version":"b7063c7426ea5a4d15e01b60538718765392f49d","versionType":"git"},{"lessThan":"b8e274e69ab09222c7a552c7c0c1eef9ce627fc1","status":"affected","version":"0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd","versionType":"git"},{"lessThan":"ddb9239828336b36d8a3ef5943fdffb2f55b6508","status":"affected","version":"89ae9df09d2c1fb4a4eb49…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/metrics/0/cvssV3_1

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:01937bcb95bc8bf7bafe464691e2df6e9482448274331a9922913ac566b32b26 · sha256:576f2eedc6a89a8e… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer