External risk intelligence

Linux Kernel ksmbd File Lifetime Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64016

The vulnerability exists in ksmbd, a kernel-based SMB server. While SMB is a network protocol, it is primarily intended for use within trusted local networks or over VPNs. It is rarely intentionally exposed directly to the public internet, though accidental exposure through misconfiguration or perimeter breaches is a known phenomenon in some deployments.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability within the Linux kernel's SMB server component that could potentially impact file access and integrity. While the direct business impact requires further assessment of system configurations, the nature of this vulnerability suggests a need for awareness regarding its presence in systems utilizing this kernel feature.

Issue affects Linux kernel SMB file access.
Remember: potential for file access and integrity issues.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a vulnerability in the Linux kernel's ksmbd component by targeting file handling during a successful durable reconnect. This involves triggering an error path after the reconnect, which can lead to the improper handling and potential freeing of file objects. If successful, this could allow an attacker to compromise data integrity and availability.

No specific access required.
Error path during durable reconnect.
Data integrity and availability risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's ksmbd component could allow an attacker to disrupt file access operations when a specific error path is triggered during a durable SMB reconnect. If this error path is reached after a successful reconnect, it may lead to the incorrect handling of file object cleanup, potentially causing issues with file availability and integrity within the affected SMB session.

File object integrity and availability.
Error path during durable reconnect.
Disruption of SMB file access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's ksmbd component affects file handling during SMB durable reconnects. The Linux kernel team is responsible for addressing this issue. The first practical step is for infrastructure and platform teams to identify all systems running the affected kernel version, confirm exposure and business criticality, and then coordinate with vendor management if applicable to plan remediation during a maintenance window.

Identify kernel owners and affected systems.
Verify exposure and business criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ksmbd in the Linux kernel?

ksmbd is a kernel-space implementation of the SMB3 protocol that allows a Linux system to share files with other computers over a network. It is built directly into the kernel to provide high-performance file sharing capabilities, often used in enterprise environments to enable native file access between Linux servers and Windows clients without needing user-space server software.

How would you describe the vulnerability in CVE-2026-64016?

This vulnerability involves a resource management error during the cleanup of file objects in the ksmbd server. Specifically, when an error occurs following a durable SMB reconnect, the system may incorrectly free a file object while a reference to it still exists in the session table. This mismatch between the kernel's tracking of the file and the actual memory state can lead to issues with data integrity and file availability.

Does any activity trigger this ksmbd flaw?

The flaw is triggered by a specific sequence of events involving a durable file reconnect. An attacker would need to initiate a connection and then cause an error path to be taken immediately after a durable reconnect succeeds. Simple, standard file access that does not trigger this specific recovery error path does not activate the underlying logic error.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal notes that while the vulnerability exists in a network-facing protocol, SMB is typically intended for trusted local networks or VPNs rather than direct public internet exposure. Systems are most relevant if they are misconfigured to be internet-facing. Internal file servers or those behind strict perimeter controls have a lower immediate risk profile compared to systems directly accessible from the public internet.

What is the first step to address this CVE?

Infrastructure teams should first create an inventory of all systems running the affected Linux kernel version that utilize the ksmbd component. Once identified, evaluate the business criticality of those specific file shares. Because this is a kernel-level issue, coordinate with your distribution maintainers to track and apply official security updates as they become available for your specific kernel release.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.