In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up… (CVE-2026-64401)
A use-after-free vulnerability in the Linux kernel's SMB client implementation (cifs_swn_notify) has been resolved. The issue arises because the function uses a cached tcon pointer that may reference freed memory when multiple mounts share the same registration ID. This can lead to unsafe operations on freed objects and lock order violations. The fix involves storing only stable witness identity information and dynamically resolving a live tcon at notification time, ensuring safe reference handling and preserving intended behavior.
AI Analysis
Technical Summary
The Linux kernel SMB client vulnerability (CVE-2026-64401) involves cifs_swn_notify() using a cached tcon pointer from a witness registration after the original tcon has been freed due to multiple mounts sharing one registration ID. This causes use-after-free conditions and lock order violations. The patch changes the design to store only stable identity data in registrations and dynamically find and pin a live tcon under proper locking when notifications arrive, preventing unsafe access to freed memory and maintaining correct notification ordering.
Potential Impact
This vulnerability can lead to use-after-free conditions in the kernel SMB client code, potentially causing kernel crashes or undefined behavior. It also violates documented lock ordering, which may lead to deadlocks or race conditions. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel SMB client code.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by redesigning the witness registration handling and notification process. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level fix, updating to the patched kernel version is the recommended mitigation. Patch status is not explicitly confirmed here; check the vendor or Linux kernel advisory for the exact fixed versions and update guidance.
In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up… (CVE-2026-64401)
Description
A use-after-free vulnerability in the Linux kernel's SMB client implementation (cifs_swn_notify) has been resolved. The issue arises because the function uses a cached tcon pointer that may reference freed memory when multiple mounts share the same registration ID. This can lead to unsafe operations on freed objects and lock order violations. The fix involves storing only stable witness identity information and dynamically resolving a live tcon at notification time, ensuring safe reference handling and preserving intended behavior.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel SMB client vulnerability (CVE-2026-64401) involves cifs_swn_notify() using a cached tcon pointer from a witness registration after the original tcon has been freed due to multiple mounts sharing one registration ID. This causes use-after-free conditions and lock order violations. The patch changes the design to store only stable identity data in registrations and dynamically find and pin a live tcon under proper locking when notifications arrive, preventing unsafe access to freed memory and maintaining correct notification ordering.
Potential Impact
This vulnerability can lead to use-after-free conditions in the kernel SMB client code, potentially causing kernel crashes or undefined behavior. It also violates documented lock ordering, which may lead to deadlocks or race conditions. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel SMB client code.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by redesigning the witness registration handling and notification process. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level fix, updating to the patched kernel version is the recommended mitigation. Patch status is not explicitly confirmed here; check the vendor or Linux kernel advisory for the exact fixed versions and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gww6-qc28-623p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64401"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420a9c2644c7f8083be2
Added to database: 07/25/2026, 23:08:58 UTC
Last enriched: 07/25/2026, 23:26:19 UTC
Last updated: 07/26/2026, 03:45:31 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.