CyberSecBulletin
CVE-2026-64437NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64437 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions a796ba4e61d5e14e07b79a359faac69f8f9b22a3, b8e274e69ab09222c7a552c7c0c1eef9ce627fc1, ddb9239828336b36d8a3ef5943fdffb2f55b6508 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.43% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to a796ba4e61d5e14e07b79a359faac69f8f9b22a3 or b8e274e69ab09222c7a552c7c0c1eef9ce627fc1 or ddb9239828336b36d8a3ef5943fdffb2f55b6508 or 94083db751930b1540ddff2b54d4677549c57f81, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.1.178 or 6.6.145 or 6.12.96 or 6.18.39, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb7063c7426ea5a4d15e01b60538718765392f49d up to, but not including, a796ba4e61d5e14e07b79a359faac69f8f9b22a3; 0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd up to, but not including, b8e274e69ab09222c7a552c7c0c1eef9ce627fc1; 89ae9df09d2c1fb4a4eb495c113a7ce1dca34147 up to, but not including, ddb9239828336b36d8a3ef5943fdffb2f55b6508; 14d2eee0193ac3cd1bf3d014373449f0b8d35d6d up to, but not including, 94083db751930b1540ddff2b54d4677549c57f81; f580d27e8928828693df44ba2db0fffdbe11dfea up to, but not including, 12c36c99655f325befe50c26842f7deca414c381; f580d27e8928828693df44ba2db0fffdbe11dfea up to, but not including, 10f293a07f9e10e988b0ae44e2e99c631f5a68e0; 2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694; 6.1.176 up to, but not including, 6.1.178; and 5 more rangesa796ba4e61d5e14e07b79a359faac69f8f9b22a3, b8e274e69ab09222c7a552c7c0c1eef9ce627fc1, ddb9239828336b36d8a3ef5943fdffb2f55b6508, 94083db751930b1540ddff2b54d4677549c57f81, 12c36c99655f325befe50c26842f7deca414c381, 10f293a07f9e10e988b0ae44e2e99c631f5a68e0
LinuxLinux Kernel6.1.176 up to, but not including, 6.1.178; 6.6.143 up to, but not including, 6.6.145; 6.12.94 up to, but not including, 6.12.96; 6.18.36 up to, but not including, 6.18.39; 7.0.13 up to, but not including, 7.1; 7.1.1 up to, but not including, 7.1.4; 7.16.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1, 7.1.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too: SMB2_CLOSE on the locking handle -> set_close_state_blocked_works() sets the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock() worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes the STATUS_RANGE_NOT_LOCKED branch with "goto out2" -- which, like the cancelled branch, skips release_async_work(). The work stays on conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock. A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL: BUG: KASAN: slab-use-after-free in __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit) ... cache file_lock_cache of size 192 Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger. Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.