{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "7f0cb478703cbeaddfe5c9101c5c73cd975d1073"
            },
            {
              "fixed": "3a436932eb397e909d0607d76a8325abd9d85a35"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "d484d621d40f4a8b8959008802d79bef3609641b"
            },
            {
              "fixed": "95f072ef934ca00711d510676b8792cbf59a5aae"
            },
            {
              "fixed": "5da69a65b282d2276de22e5194ba0f88c836170c"
            },
            {
              "fixed": "1f8f3246d55f89350a1a67bdf3744b7241048e4e"
            },
            {
              "fixed": "bf736184d063da1a552ffeff0481813599a182cc"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.11.0"
            },
            {
              "fixed": "6.12.92"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.34"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64142.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: close durable scavenger races against m_fp_list lookups\n\nksmbd_durable_scavenger() has two related races against any walker\nthat iterates f_ci-\u003em_fp_list, including ksmbd_lookup_fd_inode()\n(used by ksmbd_vfs_rename) and the share-mode checks in\nfs/smb/server/smb_common.c.\n\n(1) fp-\u003enode list-head reuse.  Durable-preserved handles can remain\nlinked on f_ci-\u003em_fp_list after session teardown so share-mode checks\nstill see them while the handle is reconnectable.  The scavenger\ncollected expired handles by adding fp-\u003enode to a local\nscavenger_list after removing them from the global durable idr.\nBecause fp-\u003enode is the same list_head used by m_fp_list,\nlist_add(\u0026fp-\u003enode, \u0026scavenger_list) overwrites the m_fp_list links\nand corrupts both lists.  CONFIG_DEBUG_LIST can report this on the\nshare-mode walk path.\n\n(2) Refcount race against m_fp_list walkers.  The scavenger qualifies\nan expired durable handle with atomic_read(\u0026fp-\u003erefcount) \u003e 1 and\nfp-\u003econn under global_ft.lock, removes fp from global_ft, then drops\nglobal_ft.lock before unlinking fp from m_fp_list and freeing it.\nDuring that gap fp is still linked on m_fp_list with f_state ==\nFP_INITED.  ksmbd_lookup_fd_inode() under m_lock read calls\nksmbd_fp_get() (atomic_inc_not_zero on refcount that is still 1) and\ntakes a live reference; the scavenger then unlinks and frees fp\nwhile the holder owns a reference, leading to UAF on the holder's\nsubsequent ksmbd_fd_put() and on any field reads performed by a\nconcurrent share-mode walker that iterates m_fp_list without taking\nksmbd_fp_get() (smb_check_perm_dleases-like paths).\n\nFix both:\n\n  * Stop reusing fp-\u003enode as a scavenger-private list node.  Remove\n    one expired handle from global_ft under global_ft.lock, take an\n    explicit transient reference, drop the lock, unlink fp-\u003enode\n    from m_fp_list under f_ci-\u003em_lock, then drop both the durable\n    lifetime and transient references with atomic_sub_and_test(2,\n    \u0026fp-\u003erefcount).  If the scavenger is the last putter the close\n    runs there; otherwise an in-flight holder that already raced\n    through the m_fp_list lookup owns the final close via its\n    ksmbd_fd_put() path.  The one-at-a-time disposal can rescan the\n    durable idr when multiple handles expire in the same pass, but\n    durable scavenging is a background expiration path and the final\n    full scan recomputes min_timeout before the next wait.\n\n  * Clear fp-\u003epersistent_id inside __ksmbd_remove_durable_fd() right\n    after idr_remove(), so a delayed final close from a holder that\n    snatched fp does not re-issue idr_remove() on a persistent id\n    that idr_alloc_cyclic() in ksmbd_open_durable_fd() may have\n    already handed out to a brand-new durable handle.\n\n  * Bypass the per-conn open_files_count decrement in\n    __put_fd_final() when fp is detached from any session table\n    (fp-\u003econn cleared by session_fd_check() at durable preserve --\n    paired with the volatile_id clear at unpublish, so checking\n    fp-\u003econn alone is sufficient).  The walker that owns the final\n    close runs from an unrelated work-\u003econn whose\n    stats.open_files_count never tracked this durable fp; without\n    this guard the holder would underflow that unrelated counter.\n\nThe two races are folded into one patch because patch (1) alone\ncleans up the corrupted list but leaves a deterministic UAF window\nfor m_fp_list walkers that the transient-reference and\npersistent_id discipline in (2) close; bisecting onto an\nintermediate state would land on a UAF that pre-patch chaos merely\nmade less reproducible.\n\nValidation:\n  * CONFIG_DEBUG_LIST coverage for the list_head reuse path.\n  * KASAN-enabled direct SMB2 durable-handle coverage that exercised\n    ksmbd_durable_scavenger() and non-NULL ksmbd_lookup_fd_inode()\n    returns while durable handles expired under concurrent rename\n    lookups, with no KASAN, UAF, list-corruption, ODEBUG, or WARNING\n    reports.\n---truncated---",
  "id": "CVE-2026-64142",
  "modified": "2026-07-22T05:29:39.210230670Z",
  "published": "2026-07-19T15:40:34.605Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f8f3246d55f89350a1a67bdf3744b7241048e4e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3a436932eb397e909d0607d76a8325abd9d85a35"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5da69a65b282d2276de22e5194ba0f88c836170c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/95f072ef934ca00711d510676b8792cbf59a5aae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bf736184d063da1a552ffeff0481813599a182cc"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64142.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64142"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ksmbd: close durable scavenger races against m_fp_list lookups"
}