Answer in brief
CVE-2026-64390 records a High severity (CVSS 8.8) vulnerability in ksmbd: track the connection owning a byte-range lock. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f5a544e3bab78142207e0242d22442db85ba1eff <22d38cf75b556c20b039743bdf3654d535b858be || >=f5a544e3bab78142207e0242d22442db85ba1eff <66eb3643164e5e1029907793926c132f8b5c6148 || >=f5a544e3bab78142207e0242d22442db85ba1eff <ea5c9bf99f626a15cc59f645dc895f2b3f01992e || >=f5a544e3bab78142207e0242d22442db85ba1eff <fe20d492a69a6f79e637f438072b212e21ed3b78 || >=f5a544e3bab78142207e0242d22442db85ba1eff <427faaa52b0b399940c1a88065a5c310d10dad15 || >=f5a544e3bab78142207e0242d22442db85ba1eff <5fecc15a30cb9ebd310f7b52c1ab607edcea78f6 || >=f5a544e3bab78142207e0242d22442db85ba1eff <c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb | 22d38cf75b556c20b039743bdf3654d535b858be, 66eb3643164e5e1029907793926c132f8b5c6148, ea5c9bf99f626a15cc59f645dc895f2b3f01992e, fe20d492a69a6f79e637f438072b212e21ed3b78, 427faaa52b0b399940c1a88065a5c310d10dad15, 5fecc15a30cb9ebd310f7b52c1ab607edcea78f6, c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichannel, the connection handling the LOCK request can be different from the connection which opened the file. The entry can therefore be removed under a different spinlock from the one protecting the list it belongs to. A concurrent traversal can then access freed struct ksmbd_lock and struct file_lock objects. Record the connection owning each lock's clist entry and hold a reference to it while the entry is linked. Use that connection and its llist_lock for unlock, rollback, close, and durable preserve. Durable reconnect assigns the new connection as the owner when publishing the locks again.
Quoted source text, attributed separately from HOL analysis.