External risk intelligence

Linux Kernel ksmbd Race Condition Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64142

The vulnerability exists in ksmbd, an in-kernel SMB server. While SMB is typically a file-sharing protocol used within internal networks or over VPNs, it is sometimes exposed directly to the internet in misconfigured environments. Because SMB is not intended for public internet exposure but is occasionally found there, this reflects a plausible but not inherently public-facing deployment pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's SMB server component could allow an attacker to corrupt data or gain unauthorized access. The issue arises from a race condition during file handle management, potentially impacting systems that use this server for file sharing. The main concern is confirming relevance and exposure to this specific SMB server implementation.

Server-side file handle corruption risk.
Potential for data integrity or access issues.
Confirm use and exposure of this SMB server.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering specific conditions within the Linux kernel's ksmbd component. This involves interacting with the SMB server in a way that causes race conditions between operations that manage file handle lists and a background process that cleans up expired handles. Successful exploitation could lead to significant system compromise.

Attackers need network access.
Triggered by concurrent handle cleanup and lookup.
Allows code execution and data corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's SMB server could potentially allow for memory corruption. This may affect the integrity and availability of the affected system when the SMB server is actively handling file operations and durable handles, particularly during session teardown or when checking share permissions.

System file handles and memory integrity.
Race conditions during handle management.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's ksmbd module, impacting its handling of SMB durable handles. Responsibility likely falls to the Linux infrastructure or platform teams managing kernel services. The initial step is to identify all systems running the affected kernel version and confirm their exposure, particularly if they host SMB shares.

Linux kernel teams own resolution.
Verify systems hosting SMB shares.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ksmbd component in the Linux kernel?

ksmbd is an in-kernel server that allows Linux systems to provide file sharing services using the SMB protocol. It enables Windows and other clients to access files over a network, acting as an integrated alternative to user-space tools like Samba. Because it operates within the kernel, it is designed for high-performance file sharing across networked environments.

What is the weakness behind CVE-2026-64142?

This vulnerability is a race condition affecting how the system manages file handles. It occurs when a background cleanup task interferes with concurrent file lookups. This conflict can lead to memory corruption or a 'use-after-free' scenario, where the system attempts to access memory that has already been released or incorrectly modified, potentially compromising system integrity.

How can an attacker trigger this vulnerability?

Exploitation requires network access to the SMB server. An attacker triggers the bug by performing operations that force the kernel to handle 'durable handles' during specific cleanup cycles. The issue does not occur during standard, quiet operation; it specifically relies on precise timing where a file lookup races against the server's background scavenger process as it tries to close expired handles.

Is my server affected if it is not on the internet?

Halo Surface Signal notes that while SMB is typically used internally or via VPN, some environments misconfigure it to be directly exposed to the internet. If your server is not internet-facing, your immediate risk of remote exploitation is lower, but the vulnerability still exists in your internal network. Any system running ksmbd that allows network-based SMB traffic should be considered relevant for review.

What steps should I take to respond to this?

Your first step is to identify all Linux systems in your environment that have the ksmbd module enabled and actively serving SMB shares. Once identified, work with your infrastructure or platform security team to verify kernel versions and track availability of vendor-supplied patches. Focus on securing SMB access and confirming whether your specific configuration uses durable handles, which are central to this issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.