CVE-2026-64142

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Two race conditions exist in the ksmbd durable scavenger() function when interacting with walkers that iterate f ci->m fp list, such as ksmbd lookup fd inode() (used by ksmbd vfs rename) and share-mode checks in fs/smb/server/smb common.c.

The first issue involves the reuse of fp->node as a list-head. When the scavenger removes expired handles from the global durable idr and adds them to a local scavenger list, it overwrites the m fp list links, leading to list corruption.

The second issue is a reference count race. The scavenger may remove a file pointer from the global table and drop the lock before unlinking it from m fp list. This creates a window where ksmbd lookup fd inode() can obtain a reference to a file pointer that the scavenger then unlinks and frees, resulting in a Use-After-Free (UAF) condition during subsequent ksmbd fd put() calls or field reads by concurrent walkers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.