The Linux kernel vulnerability CVE-2026-64397 affects the ksmbd server component handling SMB2 QUERY_DIRECTORY requests. The function smb2_query_dir() improperly stores a pointer to stack-allocated private data in the ksmbd_file's readdir_data structure. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while it is still in use by an iterate_dir() callback, causing a stack use-after-free. The fix involves introducing a per-file mutex to serialize access to the shared directory enumeration state, including scan restart, dot entry state, readdir_data setup, iteration, and response construction. This serialization prevents concurrent requests from interfering with each other's private data pointers and shared file position state.

The vulnerability results in a stack use-after-free condition in the ksmbd SMB2 server implementation within the Linux kernel. This could potentially lead to memory corruption or instability in the kernel when handling concurrent QUERY_DIRECTORY requests on the same file handle. No known exploits in the wild have been reported. The impact is limited to systems running the vulnerable Linux kernel with ksmbd enabled and handling SMB2 directory queries concurrently.

A fix has been implemented by adding a per-file mutex to serialize QUERY_DIRECTORY requests, preventing concurrent access issues. Since the vulnerability is resolved in the Linux kernel, users should apply the official kernel updates or patches that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance and apply the update accordingly.