CVE-2026-64016

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where a durable reconnect can lead to an incorrect file lifetime management. When ksmbd reopen durable fd() successfully republishes a ksmbd file into the session volatile-id table, a subsequent error path in smb2 open() may trigger redundant cleanup calls. Specifically, calling ksmbd fd put(work, fp) followed by ksmbd put durable fd(dh info.fp) on the same object can result in ksmbd close fd(NULL, fp) being executed. Since this final close operation is not session-aware, it may free the file object while leaving the volatile-id entry active in the session table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.