CVE-2026-64136 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7
https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41
https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d
https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a
https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd

History

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().
Title		smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7 https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41 https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:30.351Z

Updated: 2026-07-19T15:40:30.351Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64136

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64136", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.036Z", "datePublished": "2026-07-19T15:40:30.351Z", "dateUpdated": "2026-07-19T15:40:30.351Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T15:40:30.351Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()\n\nCommit 96c4af418586 (\"cifs: Fix locking usage for tcon fields\")\nrefactored cifs code to change cifs_tcp_ses_lock for tc_lock around\ntc_count changes.\n\nThere was missing lock around tc_count increment inside\nsmb2_find_smb_sess_tcon_unlocked()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2transport.c"], "versions": [{"version": "953953abb66e52c224057ab91e404284fefeab62", "lessThan": "7df1df6f40c0720d30206aa35c0343b962350e0d", "status": "affected", "versionType": "git"}, {"version": "601dd3b79769b38d30b693c40afdb2a4b7edf9d0", "lessThan": "13fb413ae22a37c69341918a6d651d19a9b0b9b7", "status": "affected", "versionType": "git"}, {"version": "3969db6b22e3d90d8c5f22ac1a7fe0350a94c136", "lessThan": "bf4ebdb19ff9b3cdf992b50715fe61633327416a", "status": "affected", "versionType": "git"}, {"version": "96c4af418586ee9a6aab61738644366426e05316", "lessThan": "e374f4e496fef8168784f93a4477d67be34485fd", "status": "affected", "versionType": "git"}, {"version": "96c4af418586ee9a6aab61738644366426e05316", "lessThan": "4d8690dace005a38e6dbde9ecce2da3ad85c7c41", "status": "affected", "versionType": "git"}, {"version": "8c59eeeeffa1524ef57e173a89a1a3ff539888d5", "status": "affected", "versionType": "git"}, {"version": "6.6.128", "lessThan": "6.6.142", "status": "affected", "versionType": "semver"}, {"version": "6.12.75", "lessThan": "6.12.92", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.34", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2transport.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.128", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d"}, {"url": "https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7"}, {"url": "https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a"}, {"url": "https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd"}, {"url": "https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41"}], "title": "smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()", "x_generator": {"engine": "bippy-1.2.0"}}}}