CVE-2026-64397: ksmbd: serialize QUERY_DIRECTORY requests per file

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-09-04
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.

Affected products

Linux kernel: from 5.15 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4 — fixed in 6.1.178, 6.12.96, 6.18.39, 6.6.145, 7.1.4

How to fix

Upgrade to a fixed version: Linux kernel 6.1.178, 6.12.96, 6.18.39, 6.6.145. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64397 or the next vulnerability affects your stack