CVE-2026-64396

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ksmbd component during the cancellation of deferred locks in the SMB2 LOCK path. When a blocking byte-range lock request is deferred, the system registers asynchronous work via the setup async work() function. If the lock waiter is woken up while the work state is no longer active, the cleanup process may call locks free lock(flock) before the work is removed from the async requests list. Simultaneously, the smb2 cancel() function may traverse this list and invoke the cancel callback smb2 remove blocked lock(), which attempts to access the already freed flock structure. This sequence results in a slab-use-after-free within the wake up common() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.