Loading vulnerability…
CVE-2026-64142 is a race-condition vulnerability in the Linux kernel's ksmbd in-kernel SMB server, specifically in durable-handle expiration and cleanup logic. The flaw affects interactions between ksmbd_durable_scavenger() and code paths that walk the per-inode file-pointer list, including ksmbd_lookup_fd_inode() and share-mode permission checks.
Two related defects are involved. First, the implementation reused the same list_head field for both the inode's m_fp_list membership and a scavenger-private temporary list, allowing expired durable handles to corrupt list linkage when moved for cleanup. Second, the scavenger could remove a durable handle from the global durable table, drop the global lock, and only afterward unlink and free the object while it was still visible to concurrent m_fp_list walkers. During that window, a concurrent lookup could successfully acquire a reference to the file object, or a share-mode walker could read fields from an object that was subsequently freed, resulting in a use-after-free condition. The fix also clears the durable persistent identifier at removal time to prevent stale final-close paths from acting on an identifier that may already have been reallocated, and avoids incorrect per-connection open-file accounting when the final close occurs after the handle has been detached from its original session.
The vulnerability is reachable through SMB operations involving durable handles and concurrent file activity such as rename or share-mode checks, and it affects kernel memory safety in ksmbd.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.