Critical Vulnerability: CVE-2026-64016

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix durable reconnect error path file lifetime

After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes

the same ksmbd_file into the session volatile-id table. If smb2_open()

then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)

and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).

In this case fp and dh_info.fp are the same object. The first put drops the

reconnect lookup reference, but the final durable put can run

__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,

it can free the file object without removing the volatile-id entry that was

just published into the session table.

Use the session-aware put for the final reconnect drop when the reconnect

had already succeeded and the error path is cleaning up the republished

file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep

using the durable-only put path.

CVE-2026-64016 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.8/10

EPSS (Exploit Prediction): 0.6% probability of exploitation in the next 30 days.

Use Vulnios to continuously monitor your exposure to CVE-2026-64016 and similar vulnerabilities.

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.