CVE-2026-64136

smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

State: Published
Severity: 9.8 Critical
Published: Jul 19, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes.

There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	92d197ef7e9bb4994dae2bb17c2f19fa09d219a2 to before 7585d4242f59185b084957fa077396e53dbf7c24Affected 953953abb66e52c224057ab91e404284fefeab62 to before 7df1df6f40c0720d30206aa35c0343b962350e0dAffected 601dd3b79769b38d30b693c40afdb2a4b7edf9d0 to before 13fb413ae22a37c69341918a6d651d19a9b0b9b7Affected 3969db6b22e3d90d8c5f22ac1a7fe0350a94c136 to before bf4ebdb19ff9b3cdf992b50715fe61633327416aAffected 96c4af418586ee9a6aab61738644366426e05316 to before e374f4e496fef8168784f93a4477d67be34485fdAffected 96c4af418586ee9a6aab61738644366426e05316 to before 4d8690dace005a38e6dbde9ecce2da3ad85c7c41Affected 8c59eeeeffa1524ef57e173a89a1a3ff539888d5Affected 6.6.128 to before 6.6.142Affected 6.12.75 to before 6.12.92Affected 6.18.16 to before 6.18.34Affected 6.19.6 to before 6.20Affected
LinuxLinux	7.0Affected before 7.0Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

92d197ef7e9bb4994dae2bb17c2f19fa09d219a2 to before 7585d4242f59185b084957fa077396e53dbf7c24Affected
953953abb66e52c224057ab91e404284fefeab62 to before 7df1df6f40c0720d30206aa35c0343b962350e0dAffected
601dd3b79769b38d30b693c40afdb2a4b7edf9d0 to before 13fb413ae22a37c69341918a6d651d19a9b0b9b7Affected
3969db6b22e3d90d8c5f22ac1a7fe0350a94c136 to before bf4ebdb19ff9b3cdf992b50715fe61633327416aAffected
96c4af418586ee9a6aab61738644366426e05316 to before e374f4e496fef8168784f93a4477d67be34485fdAffected
96c4af418586ee9a6aab61738644366426e05316 to before 4d8690dace005a38e6dbde9ecce2da3ad85c7c41Affected
8c59eeeeffa1524ef57e173a89a1a3ff539888d5Affected
6.6.128 to before 6.6.142Affected
6.12.75 to before 6.12.92Affected
6.18.16 to before 6.18.34Affected
6.19.6 to before 6.20Affected

LinuxLinux

7.0Affected
before 7.0Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.