What is the CVSS score of CVE-2026-64136?

CVE-2026-64136 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64136?

A reference count corruption vulnerability in the Linux kernel's in-kernel SMB/CIFS client (CVE-2026-64136) can cause system crashes or instability on servers mounting SMB2/SMB3 shares.. A patch is available.

How to fix or mitigate CVE-2026-64136?

Within 24 hours, identify all production Linux systems mounting SMB shares via the in-kernel CIFS client by checking /proc/mounts for cifs entries and current kernel versions. By day 7, procure the patched kernel version from your Linux vendor and validate patches in staging with representative CIFS mount workloads. Within 30 days, deploy patches to all affected systems in priority order-file servers and business-critical NAS dependencies first-and verify mount stability post-deployment.

Linux Kernel CVE-2026-64136

EUVD-2026-45821 CRITICAL

2026-07-19 Linux

GHSA-6vvf-f9vp-vcgv

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Refcount race needs local activity on an active SMB mount and precise timing (AV:L/AC:H/PR:L); most likely outcome is kernel crash (A:H) with possible memory leak (C:L), no clear integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:40 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes.

There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().

AnalysisAI

Refcount race in the Linux kernel SMB/CIFS client (smb2_find_smb_sess_tcon_unlocked) leaves a tc_count increment unprotected by tc_lock, so concurrent tree-connect lookups can corrupt the tcon reference count and lead to premature free / use-after-free of the tcon object. It affects hosts that mount SMB2/SMB3 shares via the in-kernel cifs client and is a regression introduced by commit 96c4af418586 which converted tc_count locking from cifs_tcp_ses_lock to tc_lock but missed this one increment site. No public exploit is identified at time of analysis and EPSS is low (0.18%); the vendor-carried CVSS of 9.8 is auto-generated boilerplate that is not well supported by the actual local, race-conditioned nature of the bug.

Technical ContextAI

The affected component is the kernel's cifs/smb-client subsystem (fs/smb/client) which implements SMB2/SMB3 protocol handling for mounting remote Windows/Samba shares. A 'tcon' (tree connection) object represents a connected share and is reference-counted via tc_count, guarded by the per-connection tc_lock spinlock. Commit 96c4af418586 ('cifs: Fix locking usage for tcon fields') migrated tc_count updates from the coarse cifs_tcp_ses_lock to the finer-grained tc_lock, but the increment inside smb2_find_smb_sess_tcon_unlocked() (a lookup helper that walks session/tcon lists to match an incoming response) was left without the new lock. The root-cause class is a concurrency/locking defect (CWE-362 race condition, with CWE-416 use-after-free as the plausible downstream consequence); the CWE field is reported as N/A in the source data. An unsynchronized non-atomic increment can race with a decrement/free path, skewing the refcount so the tcon is freed while still in use.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later) matching your series - via your distribution's kernel package and reboot. The fix is also available as upstream stable commits (7df1df6f40c0720d30206aa35c0343b962350e0d and the related backports at https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7 and siblings), so if you build kernels yourself, cherry-pick the corresponding commit for your branch. As a compensating control until patched, avoid mounting SMB/CIFS shares from untrusted or attacker-influenced servers and limit which users can initiate mounts; where cifs client functionality is unused, unload or blacklist the cifs module (modprobe -r cifs / blacklist in modprobe.d) to remove the vulnerable code path entirely - the trade-off is loss of SMB mount capability on that host. Reducing concurrent access to shared mounts lowers the odds of hitting the race but is not a reliable fix.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64136 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64136

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code