CVE-2026-64397 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: serialize QUERY_DIRECTORY requests per file
smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free.
Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel affects the ksmbd implementation within the smb2_query_dir() function, where concurrent directory enumeration operations can lead to critical memory safety issues. This flaw occurs when multiple QUERY_DIRECTORY requests utilize the same file handle, creating a race condition that allows simultaneous access to shared directory enumeration state. The core technical issue manifests through improper synchronization mechanisms that fail to protect the stack-allocated private data stored in the ksmbd_file readdir_data structure.
The vulnerability stems from the lack of proper serialization between concurrent directory enumeration requests, specifically when multiple threads or processes attempt to query directory contents simultaneously using identical file handles. During normal operation, smb2_query_dir() stores a pointer to its stack-allocated private data within the ksmbd_file readdir_data structure, which serves as a temporary storage mechanism for directory iteration state information. When concurrent requests occur, one request may overwrite the private data pointer while another request's iterate_dir() callback is still actively referencing the original data, creating a classic use-after-free condition that can lead to memory corruption and potential privilege escalation.
This memory safety issue directly impacts system stability and security posture by exposing the kernel to potential exploitation through controlled memory corruption attacks. The vulnerability operates at the kernel level within the SMB2 protocol implementation, making it particularly dangerous as it can be triggered through network-based SMB connections without requiring local system access. The use-after-free condition creates opportunities for attackers to manipulate kernel memory layouts, potentially leading to arbitrary code execution with kernel privileges or system compromise.
The mitigation implemented addresses this vulnerability by introducing a per-file mutex mechanism that serializes all directory enumeration operations on shared file handles. This solution covers multiple critical components including scan restart functionality, dot entry state management, readdir_data setup and iteration processes, and response construction phases. The lock ensures that only one request can access the shared directory enumeration state at any given time, preventing race conditions between concurrent operations while also maintaining proper file position serialization across multiple requests.
This vulnerability aligns with common weakness enumerations such as CWE-416 for use-after-free conditions and CWE-362 for concurrent execution issues. From an attack perspective, this flaw corresponds to techniques described in the ATT&CK framework under T1059 for command and scripting interpreter usage and potentially T1068 for exploit development through kernel vulnerabilities. The fix demonstrates proper defensive programming practices by implementing appropriate synchronization primitives to protect shared resources in multi-threaded kernel environments, following established security principles for preventing race conditions and memory safety violations in kernel space operations.