{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL  Commit f580d27e8928 (\"ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too:    SMB2_CLOSE on the locking handle -\u003e set_close_state_blocked_works() sets   the deferred work's state to KSMBD_WORK_CLOSED and wakes the smb2_lock()   worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s   the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes   the STATUS_RANGE_NOT_LOCKED branch with \"goto out2\" -- which, like the   cancelled branch, skips release_async_work(). The work stays on   conn-\u003easync_requests with a live cancel_fn = smb2_remove_blocked_lock   pointing at the freed file_lock.  A subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:    BUG: KASAN: slab-use-after-free in __locks_delete_block     __locks_delete_block     locks_delete_block     ksmbd_vfs_posix_lock_unblock     smb2_remove_blocked_lock     smb2_cancel                 \u003c- 2nd SMB2_CANCEL fires cancel_fn     handle_ksmbd_work   Allocated by ...: locks_alloc_lock \u003c- smb2_lock   Freed by ...:     locks_free_lock  \u003c- smb2_lock (non-ACTIVE early-exit)   ... cache file_lock_cache of size 192  Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the splat is attributable to the CLOSE trigger.  Only an ACTIVE deferred work may have its cancel_fn fired: both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped.",
  "id": "DEBIAN-CVE-2026-64437",
  "modified": "2026-09-14T16:47:47.392250896Z",
  "published": "2026-07-25T10:17:28.160Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64437"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64437"
  ]
}