CVE-2026-64397
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.
Affected versions
Fixed in
6.1.178,
6.6.145,
6.12.96,
6.18.39,
7.1.4,
7.2-rc1
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-64397?
CVE-2026-64397 is a unscored severity Linux kernel vulnerability . CVE-2026-64397 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64397?
Yes. CVE-2026-64397 has been patched. Fixed versions include 6.1.178, 6.6.145, 6.12.96 and others.
-
Is CVE-2026-64397 actively exploited?
No. CVE-2026-64397 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.