PT-2026-64622 · Linux · Linux
CVE-2026-64401
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
smb: client: resolve SWN tcon from live registrations
cifs swn notify() looks up a witness registration by id under
cifs swnreg idr mutex, drops the mutex, and then uses the registration's
cached tcon pointer. That pointer is not a lifetime reference, and it is
not a stable representative once cifs get swn reg() lets multiple tcons
for the same net/share name share one registration id.
A same-share second mount can keep the cifs swn reg alive after the first
tcon unregisters and is freed. The registration then still points at the
freed first tcon, so taking tc lock or incrementing tc count through
swnreg->tcon only moves the use-after-free earlier. Taking tc lock while
holding cifs swnreg idr mutex also violates the documented CIFS lock
order.
Fix this by making the registration store only the stable witness
identity: id, net name, share name, and notify flags. When a notify
arrives, copy that identity under cifs swnreg idr mutex, drop the mutex,
then find and pin a live witness tcon that currently matches the net/share
pair under the normal cifs tcp ses lock -> tc lock order. The notification
path uses that pinned tcon directly and drops the reference when done.
Registration and unregister messages now use the live tcon passed by the
caller instead of a cached tcon in the registration. The final unregister
send is folded into cifs swn unregister() while the registration is still
protected by cifs swnreg idr mutex. This removes the previous
find/drop/reacquire raw-pointer window. The release path only removes the
idr entry and frees the stable identity strings.
This preserves the intended one-registration/many-tcon behavior: a
registration id represents a net/share pair, and notify handling acts on a
live representative selected at use time. It also preserves CLIENT MOVE
ordering for the representative tcon because the old-IP unregister is sent
before cifs swn register() sends the new-IP register.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux