{
  "cveId": "CVE-2026-64142",
  "url": "https://patchblox.com/security/cve/CVE-2026-64142",
  "summary": "CVE-2026-64142 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-64142, released July 20, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: close durable scavenger races against m_f...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: close durable scavenger races against m_fp_list lookups  ksmbd_durable_scavenger() has two related races against any walker that iterates f_ci-\u003Em_fp_list, including ksmbd_lookup_fd_inode() (used by ksmbd_vfs_rename) and the share-mode checks in fs/smb/server/smb_common.c.  (1) fp-\u003Enode list-head reuse.  Durable-preserved handles can remain linked on f_ci-\u003Em_fp_list after session teardown so share-mode checks still see them while the handle is reconnectable.  The scavenger collected expired handles by adding fp-\u003Enode to a local scavenger_list after removing them from the global durable idr. Because fp-\u003Enode is the same list_head used by m_fp_list, list_add(\u0026fp-\u003Enode, \u0026scavenger_list) overwrites the m_fp_list links and corrupts both lists.  CONFIG_DEBUG_LIST can report this on the share-mode walk path.  (2) Refcount race against m_fp_list walkers.  The scavenger qualifies an expired durable handle with atomic_read(\u0026fp-\u003Erefcount) \u003E 1 and fp-\u003Econn under global_ft.lock, removes fp from global_ft, then drops global_ft.lock before unlinking fp from m_fp_list and freeing it. During that gap fp is still linked on m_fp_list with f_state == FP_INITED.  ksmbd_lookup_fd_inode() under m_lock read calls ksmbd_fp_get() (atomic_inc_not_zero on refcount that is still 1) and takes a live reference; the scavenger then unlinks and frees fp while the holder owns a reference, leading to UAF on the holder\u0027s subsequent ksmbd_fd_put() and on any field reads performed by a concurrent share-mode walker that iterates m_fp_list without taking ksmbd_fp_get() (smb_check_perm_dleases-like paths).  Fix both:    * Stop reusing fp-\u003Enode as a scavenger-private list node.  Remove     one expired handle from global_ft under global_ft.lock, take an     explicit transient reference, drop the lock, unlink fp-\u003Enode     from m_fp_list under f_ci-\u003Em_lock, then drop both the durable     lifetime and transient references with atomic_sub_and_test(2,     \u0026fp-\u003Erefcount).  If the scavenger is the last putter the close     runs there; otherwise an in-flight holder that already raced     through the m_fp_list lookup owns the final close via its     ksmbd_fd_put() path.  The one-at-a-time disposal can rescan the     durable idr when multiple handles expire in the same pass, but     durable scavenging is a background expiration path and the final     full scan recomputes min_timeout before the next wait.    * Clear fp-\u003Epersistent_id inside __ksmbd_remove_durable_fd() right     after idr_remove(), so a delayed final close from a holder that     snatched fp does not re-issue idr_remove() on a persistent id     that idr_alloc_cyclic() in ksmbd_open_durable_fd() may have     already handed out to a brand-new durable handle.    * Bypass the per-conn open_files_count decrement in     __put_fd_final() when fp is detached from any session table     (fp-\u003Econn cleared by session_fd_check() at durable preserve --     paired with the volatile_id clear at unpublish, so checking     fp-\u003Econn alone is sufficient).  The walker that owns the final     close runs from an unrelated work-\u003Econn whose     stats.open_files_count never tracked this durable fp; without     this guard the holder would underflow that unrelated counter.  The two races are folded into one patch because patch (1) alone cleans up the corrupted list but leaves a deterministic UAF window for m_fp_list walkers that the transient-reference and persistent_id discipline in (2) close; bisecting onto an intermediate state would land on a UAF that pre-patch chaos merely made less reproducible.  Validation:   * CONFIG_DEBUG_LIST coverage for the list_head reuse path.   * KASAN-enabled direct SMB2 durable-handle coverage that exercised     ksmbd_durable_scavenger() and non-NULL ksmbd_lookup_fd_inode()     returns while durable handles expired under concurrent rename     lookups, with no KASAN, UAF, list-corruption, ODEBUG, or WARNING     reports. ---truncated---",
  "published": "2026-07-19T16:17:56Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00705,
  "epssPercentile": 0.53575,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.94-1",
      "fix": "DEBIAN-CVE-2026-64142",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64142",
      "released": "2026-07-20T12:58:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.0.12-1",
      "fix": "DEBIAN-CVE-2026-64142",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64142",
      "released": "2026-07-20T12:58:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}