CVE-2026-64136
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In the Linux kernel, a missing lock around the tc_count increment in smb2_find_smb_sess_tcon_unlocked() was found. This issue arose after a refactoring of CIFS code that changed locking from cifs_tcp_ses_lock to tc_lock but did not cover this specific location.
Risk Assessment
Lack of synchronization can lead to a race condition on the tc_count counter, potentially causing incorrect SMB session management, system crashes, or data integrity violations.
Recommendation
Immediately apply the Linux kernel patch addressing CVE-2026-64136, which adds proper tc_lock locking in the smb2_find_smb_sess_tcon_unlocked() function.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().