{"id":15012,"date":"2026-09-04T19:02:21","date_gmt":"2026-09-04T11:02:21","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64016"},"modified":"2026-09-04T19:02:21","modified_gmt":"2026-09-04T11:02:21","slug":"cve-2026-64016","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64016","title":{"rendered":"CVE-2026-64016 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix durable re"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ksmbd: fix durable reconnect error path file lifetime<\/p>\n<p>After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes<br \/>\nthe same ksmbd_file into the session volatile-id table. If smb2_open()<br \/>\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)<br \/>\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).<\/p>\n<p>In this case fp and dh_info.fp are the same object. The first put drops the<br \/>\nreconnect lookup reference, but the final durable put can run<br \/>\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,<br \/>\nit can free the file object without removing the volatile-id entry that was<br \/>\njust published into the session table.<\/p>\n<p>Use the session-aware put for the final reconnect drop when the reconnect<br \/>\nhad already succeeded and the error path is cleaning up the republished<br \/>\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep<br \/>\nusing the durable-only put path.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ksmbd: fix durable reconnect error path file lifetime<\/p>\n<p>After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes<br \/>\nth<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15012","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15012"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}