In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a… (CVE-2026-64397)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented by adding a per-file mutex to serialize QUERY_DIRECTORY requests, preventing concurrent access issues. Since the vulnerability is resolved in the Linux kernel, users should apply the official kernel updates or patches that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance and apply the update accordingly.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.
Impact
The vulnerability results in a stack use-after-free condition in the ksmbd SMB2 server implementation within the Linux kernel. This could potentially lead to memory corruption or instability in the kernel when handling concurrent QUERY_DIRECTORY requests on the same file handle. No known exploits in the wild have been reported. The impact is limited to systems running the vulnerable Linux kernel with ksmbd enabled and handling SMB2 directory queries concurrently.
Summary
The Linux kernel vulnerability CVE-2026-64397 affects the ksmbd server component handling SMB2 QUERY_DIRECTORY requests. The function smb2_query_dir() improperly stores a pointer to stack-allocated private data in the ksmbd_file's readdir_data structure. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while it is still in use by an iterate_dir() callback, causing a stack use-after-free. The fix involves introducing a per-file mutex to serialize access to the shared directory enumeration state, including scan restart, dot entry state, readdir_data setup, iteration, and response construction. This serialization prevents concurrent requests from interfering with each other's private data pointers and shared file position state.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64397 (opens in a new tab)
- git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908 (opens in a new tab)
- git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2 (opens in a new tab)
- git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24 (opens in a new tab)
- git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199 (opens in a new tab)
- git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8 (opens in a new tab)
- git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d (opens in a new tab)