PT-2026-64618 · Linux · Linux

CVE-2026-64397 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: serialize QUERY DIRECTORY requests per file

smb2 query dir() stores a pointer to its stack-allocated private data in the ksmbd file readdir data. Concurrent QUERY DIRECTORY requests using the same file handle can overwrite this pointer while an iterate dir() callback is still using it, resulting in a stack use-after-free.

Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir data setup and iteration, and response construction. This prevents another request from replacing readdir data.private before the current request has finished using it and also serializes the shared file position.

Related Identifiers

CVE-2026-64397

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64397 · Security Note
• https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24 · Note
• https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8 · Note
• https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d · Note
• https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908 · Note
• https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199 · Note
• https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2 · Note