CVE-2026-64136
A race condition in the Linux CIFS client can allow an attacker to corrupt kernel memory. This could lead to a system crash or arbitrary code execution. The issue was fixed in a kernel commit that added proper locking.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running the CIFS client, especially those using SMB/CIFS file shares. System administrators and users who mount SMB shares on Linux servers or desktops are affected.
Real-world impact
An attacker could exploit the race condition to crash the system or execute code with kernel privileges, potentially taking full control of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication, with no user interaction, and can compromise confidentiality, integrity, and availability of the system.
What to do about it
- 011. Update your Linux kernel to a version that includes commit 96c4af418586. 2. Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.