CVE-2026-64396

A flaw was found in ksmbd, a component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability in the SMB2_LOCK deferred-lock cancellation mechanism. This flaw occurs when a file lock is freed prematurely while still being referenced, potentially leading to a system crash (denial of service) or arbitrary code execution.

An Important severity use-after-free flaw was found in the Linux kernel's ksmbd SMB server subsystem, in the SMB2_LOCK deferred-lock cancellation path. When a blocking byte-range lock request is deferred (FILE_LOCK_DEFERRED), ksmbd registers asynchronous work on the connection's async_requests list. If the lock waiter is woken while a concurrent cancellation is in progress, the cleanup path frees the file lock (struct file_lock) without first dequeuing the work, and the cancel callback smb2_remove_blocked_lock() can then dereference the already-freed lock, resulting in a slab-use-after-free. A remote attacker with an authenticated SMB session (low privileges) could race SMB2 lock and cancellation requests to trigger this flaw, causing a kernel crash (denial of service) or potentially arbitrary code execution. Red Hat rates this flaw with a CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream CVEORG score of 8.8 (AC:L), because successful exploitation requires winning a race between the deferred lock wake-up and a concurrent cancellation, making reliable exploitation, particularly for code execution, difficult. No Red Hat products are affected by this flaw: the vulnerable code is not present in the shipped kernel and kernel-rt packages of Red Hat Enterprise Linux or Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.