The Linux kernel ksmbd component had a use-after-free vulnerability involving deferred file_lock objects during SMB2_CLOSE followed by SMB2_CANCEL operations. The problem arises because the deferred work's state transitions to CLOSED, freeing the file_lock but leaving a live cancel function pointer. A subsequent SMB2_CANCEL call then triggers this cancel function on the freed file_lock, causing a use-after-free. The issue was reproduced with KASAN on kernel 7.1-rc7. The fix involves ensuring that only ACTIVE deferred work has its cancel function fired, skipping non-active states (CANCELLED and CLOSED) to prevent double freeing and use-after-free conditions.

This vulnerability can lead to kernel memory corruption due to use-after-free of file_lock structures in the ksmbd SMB server. Exploitation could cause kernel crashes or instability. The vulnerability requires an authenticated SMB client to trigger the condition. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a kernel vulnerability, applying the latest Linux kernel updates that include the fix for CVE-2026-64437 is recommended once available. Until then, restricting SMB client access to trusted users may reduce risk.