{
  "cveId": "CVE-2026-64437",
  "url": "https://patchblox.com/security/cve/CVE-2026-64437",
  "summary": "CVE-2026-64437 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64437, released July 26, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of a deferred file_loc...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL  Commit f580d27e8928 (\u0022ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\u0022) made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:    SMB2_CLOSE on the locking handle -\u003E set_close_state_blocked_works() sets   the deferred work\u0027s state to KSMBD_WORK_CLOSED and wakes the smb2_lock()   worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s   the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes   the STATUS_RANGE_NOT_LOCKED branch with \u0022goto out2\u0022 -- which, like the   cancelled branch, skips release_async_work(). The work stays on   conn-\u003Easync_requests with a live cancel_fn = smb2_remove_blocked_lock   pointing at the freed file_lock.  A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:    BUG: KASAN: slab-use-after-free in __locks_delete_block     __locks_delete_block     locks_delete_block     ksmbd_vfs_posix_lock_unblock     smb2_remove_blocked_lock     smb2_cancel                 \u003C- 2nd SMB2_CANCEL fires cancel_fn     handle_ksmbd_work   Allocated by ...: locks_alloc_lock \u003C- smb2_lock   Freed by ...:     locks_free_lock  \u003C- smb2_lock (non-ACTIVE early-exit)   ... cache file_lock_cache of size 192  Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.  Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.",
  "published": "2026-07-25T10:17:28Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00435,
  "epssPercentile": 0.38013,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.180-1",
      "fix": "DEBIAN-CVE-2026-64437",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64437",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.96-1",
      "fix": "DEBIAN-CVE-2026-64437",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64437",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.4-1",
      "fix": "DEBIAN-CVE-2026-64437",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64437",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.100-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-64437",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64437",
      "released": "2026-07-26T13:52:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}