Critical severity · published Jul 19, 2026
CVE-2026-64136
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields")
refactored cifs code to change cifs_tcp_ses_lock for tc_lock around
tc_count changes.
There was missing lock around tc_count increment inside
smb2_find_smb_sess_tcon_unlocked().
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
6.6.128 before 6.6.142; 6.12.75 before 6.12.92; 6.18.16 before 6.18.34; 6.19.6 before 7.0.11; 7.1; 7.1; +2 more · source: NVD
LI
Linux · Linux
953953abb66e52c224057ab91e404284fefeab62 before 7df1df6f40c0720d30206aa35c0343b962350e0d; 601dd3b79769b38d30b693c40afdb2a4b7edf9d0 before 13fb413ae22a37c69341918a6d651d19a9b0b9b7; 3969db6b22e3d90d8c5f22ac1a7fe0350a94c136 before bf4ebdb19ff9b3cdf992b50715fe61633327416a; 96c4af418586ee9a6aab61738644366426e05316 before e374f4e496fef8168784f93a4477d67be34485fd; 96c4af418586ee9a6aab61738644366426e05316 before 4d8690dace005a38e6dbde9ecce2da3ad85c7c41; 8c59eeeeffa1524ef57e173a89a1a3ff539888d5; +5 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64136
Patch
https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7
Patch
https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41
Patch
https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d
Patch
https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a
Patch
https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability