01 Record

CVE-2026-64437

ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.43% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 37.5% of scored records. A rank, not a probability.
NVD base score: 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Analyzed. NVD last modified this record on 2026-09-03.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-25 08:51Z3 MO AGO

Last updated

2026-08-17 04:55Z2 MO AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant
CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

4609a59df67a057cc495bb2947540b0a9a547565147a842613ebbb737f16ba23

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxb7063c7426ea5a4d15e01b60538718765392f49d to < a796ba4e61d5e14e07b79a359faac69f8f9b22a3, 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd to < b8e274e69ab09222c7a552c7c0c1eef9ce627fc1, 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 to < ddb9239828336b36d8a3ef5943fdffb2f55b6508, 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d to < 94083db751930b1540ddff2b54d4677549c57f81, f580d27e8928828693df44ba2db0fffdbe11dfea to < 12c36c99655f325befe50c26842f7deca414c381, f580d27e8928828693df44ba2db0fffdbe11dfea to < 10f293a07f9e10e988b0ae44e2e99c631f5a68e0, 2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694, 6.1.176 to < 6.1.178, 6.6.143 to < 6.6.145, 6.12.94 to < 6.12.96, 6.18.36 to < 6.18.39, 7.0.13 to < 7.1, 7.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3
git.kernel.orghttps://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1
git.kernel.orghttps://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508
git.kernel.orghttps://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81
git.kernel.orghttps://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381
git.kernel.orghttps://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1
linux-6.12
Fixed in 6.12.100-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.96-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.