CVE-2026-64437 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:
SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock() worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the cancelled branch, skips release_async_work(). The work stays on conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock.
A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:
BUG: KASAN: slab-use-after-free in __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit) ... cache file_lock_cache of size 192
Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.
Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides within the ksmbd subsystem of the Linux kernel, specifically addressing a use-after-free condition affecting deferred file_lock structures during concurrent SMB2_CLOSE and SMB2_CANCEL operations. This flaw manifests when a file lock is associated with an asynchronous work item that transitions through multiple states including ACTIVE, CANCELLED, and CLOSED. The root cause stems from improper state handling in the smb2_cancel() function which fails to account for all possible terminal states of ksmbd work items, leading to scenarios where a cancel_fn callback executes against already freed memory resources.
The technical implementation involves a race condition between SMB2_CLOSE and SMB2_CANCEL operations on the same locking handle. When SMB2_CLOSE is processed, set_close_state_blocked_works() transitions the deferred work's state from ACTIVE to CLOSED. The smb2_lock() worker function then processes this work item but exits early due to the non-ACTIVE state, resulting in locks_free_lock() being called which frees the underlying file_lock structure. However, because the state check in smb2_lock() only excludes CANCELLED works and not CLOSED ones, the release_async_work() function is bypassed, leaving the work item still referenced in conn->async_requests with a dangling cancel_fn pointer pointing to the freed file_lock.
When a subsequent SMB2_CANCEL operation targets the same AsyncId, it passes through the KSMBD_WORK_CANCELLED guard condition because the work's state is now CLOSED rather than CANCELLED. This causes smb2_cancel() to invoke the cancel_fn callback again over the previously freed file_lock structure, resulting in a use-after-free memory access that triggers KASAN (Kernel Address Sanitizer) detection and ultimately leads to kernel panic or system instability. The vulnerability is classified under CWE-416 as Use After Free, representing a classic memory safety issue where program code attempts to access memory after it has been freed.
This security flaw impacts the integrity of the SMB2 protocol implementation within Linux kernel versions including mainline 7.1-rc7, which already incorporated partial mitigation patch f580d27e8928. The exploitation requires authenticated access from an SMB client and manifests through a specific sequence involving both CLOSE and CANCEL operations on the same locking resource. The vulnerability directly violates ATT&CK technique T1499.004 (Virtualization/Sandbox Evasion) by potentially allowing privilege escalation or denial-of-service conditions within the kernel's file locking subsystem, affecting system availability and data integrity in networked environments relying on SMB2 protocol support.
The recommended mitigation involves modifying the smb2_cancel() function to implement a comprehensive state check that only allows cancel_fn execution for ACTIVE work items. This requires adding an explicit KSMBD_WORK_ACTIVE validation before proceeding with cancel_fn invocation, ensuring that any work in terminal states (CANCELLED or CLOSED) are skipped entirely. This approach prevents the dual execution scenario where a single file_lock structure is accessed twice after being freed, thereby eliminating the use-after-free vulnerability while maintaining proper asynchronous work management within the ksmbd subsystem's locking framework.