---
id: CVE-2026-64136
title: 'smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

  Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields")
  refactored cifs code to c…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 953953abb66e52c224057ab91e404284fefeab62 <
    7df1df6f40c0720d30206aa35c0343b962350e0d
  - >-
    Linux >= 601dd3b79769b38d30b693c40afdb2a4b7edf9d0 <
    13fb413ae22a37c69341918a6d651d19a9b0b9b7
  - >-
    Linux >= 3969db6b22e3d90d8c5f22ac1a7fe0350a94c136 <
    bf4ebdb19ff9b3cdf992b50715fe61633327416a
  - >-
    Linux >= 96c4af418586ee9a6aab61738644366426e05316 <
    e374f4e496fef8168784f93a4477d67be34485fd
  - >-
    Linux >= 96c4af418586ee9a6aab61738644366426e05316 <
    4d8690dace005a38e6dbde9ecce2da3ad85c7c41
  - Linux 8c59eeeeffa1524ef57e173a89a1a3ff539888d5
  - Linux >= 6.6.128 < 6.6.142
  - Linux >= 6.12.75 < 6.12.92
  - Linux >= 6.18.16 < 6.18.34
  - Linux >= 6.19.6 < 6.20
  - Linux 7.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:36:58.919141Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:24.842Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64136'
references:
  - url: 'https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d'
  - url: 'https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7'
  - url: 'https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a'
  - url: 'https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd'
  - url: 'https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41'
tags:
  - cve.org
epss: 0.00491
epssPercentile: 0.40779
ingestedAt: '2026-10-16T17:24:46.809Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields")
refactored cifs code to change cifs_tcp_ses_lock for tc_lock around
tc_count changes.

There was missing lock around tc_count increment inside
smb2_find_smb_sess_tcon_unlocked().

## Affected

- `Linux >= 953953abb66e52c224057ab91e404284fefeab62 < 7df1df6f40c0720d30206aa35c0343b962350e0d`
- `Linux >= 601dd3b79769b38d30b693c40afdb2a4b7edf9d0 < 13fb413ae22a37c69341918a6d651d19a9b0b9b7`
- `Linux >= 3969db6b22e3d90d8c5f22ac1a7fe0350a94c136 < bf4ebdb19ff9b3cdf992b50715fe61633327416a`
- `Linux >= 96c4af418586ee9a6aab61738644366426e05316 < e374f4e496fef8168784f93a4477d67be34485fd`
- `Linux >= 96c4af418586ee9a6aab61738644366426e05316 < 4d8690dace005a38e6dbde9ecce2da3ad85c7c41`
- `Linux 8c59eeeeffa1524ef57e173a89a1a3ff539888d5`
- `Linux >= 6.6.128 < 6.6.142`
- `Linux >= 6.12.75 < 6.12.92`
- `Linux >= 6.18.16 < 6.18.34`
- `Linux >= 6.19.6 < 6.20`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.