{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-64016",
  "modified": "2026-10-07T14:35:31Z",
  "upstream": [
    "CVE-2026-64016"
  ],
  "published": "2026-07-19T15:41:06Z",
  "summary": "ksmbd: fix durable reconnect error path file lifetime",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix durable reconnect error path file lifetime\n\nAfter a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes\nthe same ksmbd_file into the session volatile-id table. If smb2_open()\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).\n\nIn this case fp and dh_info.fp are the same object. The first put drops the\nreconnect lookup reference, but the final durable put can run\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,\nit can free the file object without removing the volatile-id entry that was\njust published into the session table.\n\nUse the session-aware put for the final reconnect drop when the reconnect\nhad already succeeded and the error path is cleaning up the republished\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep\nusing the durable-only put path.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.18.33-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-2712",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v6",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v7",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v8",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.33-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.18.33-1+rpt1": {
            "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412",
            "upstream_version": "6.18.33",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.34"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64016"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5e641e4ee0bc1937408d41051a908ad4151be63b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/478bfaa036bd0c7e179acff8b8484bccdee3b8c7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a1a39f227c80cbf369767badc32cba2b225147d1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3515503322f4819277091839eed46b695096aca5"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-14T12:06:03Z"
  }
}