# CVE-2026-64437: linux: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of a deferred file_loc...

CVE-2026-64437 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64437, released July 26, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-64437
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0044
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 25, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL  Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:    SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets   the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()   worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s   the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes   the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the   cancelled branch, skips release_async_work(). The work stays on   conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock   pointing at the freed file_lock.  A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:    BUG: KASAN: slab-use-after-free in __locks_delete_block     __locks_delete_block     locks_delete_block     ksmbd_vfs_posix_lock_unblock     smb2_remove_blocked_lock     smb2_cancel                 <- 2nd SMB2_CANCEL fires cancel_fn     handle_ksmbd_work   Allocated by ...: locks_alloc_lock <- smb2_lock   Freed by ...:     locks_free_lock  <- smb2_lock (non-ACTIVE early-exit)   ... cache file_lock_cache of size 192  Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.  Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-64437](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64437.md) | Jul 26, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.96-1 | [DEBIAN-CVE-2026-64437](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64437.md) | Jul 26, 2026 |
| Linux | linux Debian 14 | 7.1.4-1 | [DEBIAN-CVE-2026-64437](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64437.md) | Jul 26, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.100-1~deb12u1 | [DEBIAN-CVE-2026-64437](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64437.md) | Jul 26, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.