CVE-2026-64397: ksmbd: serialize QUERY_DIRECTORY requests per file
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: serialize QUERYDIRECTORY requests per file
smb2querydir() stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this pointer while an iteratedir() callback is still using it, resulting in a stack use-after-free.
Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdirdata setup and iteration, and response construction. This prevents another request from replacing readdirdata.private before the current request has finished using it and also serializes the shared file position.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64397?
CVE-2026-64397 has a critical severity score of 9.8.
How do I fix CVE-2026-64397?
To mitigate CVE-2026-64397, update your Linux kernel to the latest version where this vulnerability has been resolved.
What type of vulnerability is CVE-2026-64397?
CVE-2026-64397 is classified as a Use After Free vulnerability in the Linux kernel.
What impact does CVE-2026-64397 have on systems?
CVE-2026-64397 could allow concurrent QUERY_DIRECTORY requests to affect file operations, leading to potential information disclosure or system instability.
When was CVE-2026-64397 published?
CVE-2026-64397 was published on July 25, 2026.