CVE-2026-64401 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: resolve SWN tcon from live registrations
cifs_swn_notify() looks up a witness registration by id under cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a lifetime reference, and it is not a stable representative once cifs_get_swn_reg() lets multiple tcons for the same net/share name share one registration id.
A same-share second mount can keep the cifs_swn_reg alive after the first tcon unregisters and is freed. The registration then still points at the freed first tcon, so taking tc_lock or incrementing tc_count through swnreg->tcon only moves the use-after-free earlier. Taking tc_lock while holding cifs_swnreg_idr_mutex also violates the documented CIFS lock order.
Fix this by making the registration store only the stable witness identity: id, net name, share name, and notify flags. When a notify arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex, then find and pin a live witness tcon that currently matches the net/share pair under the normal cifs_tcp_ses_lock -> tc_lock order. The notification path uses that pinned tcon directly and drops the reference when done.
Registration and unregister messages now use the live tcon passed by the caller instead of a cached tcon in the registration. The final unregister send is folded into cifs_swn_unregister() while the registration is still protected by cifs_swnreg_idr_mutex. This removes the previous find/drop/reacquire raw-pointer window. The release path only removes the idr entry and frees the stable identity strings.
This preserves the intended one-registration/many-tcon behavior: a registration id represents a net/share pair, and notify handling acts on a live representative selected at use time. It also preserves CLIENT_MOVE ordering for the representative tcon because the old-IP unregister is sent before cifs_swn_register() sends the new-IP register.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical use-after-free condition in the Linux CIFS client implementation that arises from improper handling of witness registration and tcon (tree connection) lifecycle management. This flaw exists within the smb client subsystem where the cifs_swn_notify() function performs a lookup of witness registrations by ID while holding the cifs_swnreg_idr_mutex lock, subsequently dropping this mutex before utilizing a cached tcon pointer stored in the registration structure. The fundamental issue stems from the fact that this cached pointer does not constitute a lifetime reference and becomes invalid when multiple tree connections for the same network/share combination share a single registration ID. When a second mount operation occurs on the same share while the first connection is being torn down, the registration object can remain alive even after its original tcon has been freed, creating a dangerous scenario where subsequent operations attempt to access freed memory through the stale pointer.
The technical implementation flaw manifests when multiple tree connections for identical net/share pairs are managed under a single registration ID, violating the expected one-to-one correspondence between registration objects and active tcon instances. This design enables a race condition where the notification handler accesses a freed tcon structure through the cached pointer, effectively transforming what should be a controlled resource management scenario into an exploitable use-after-free vulnerability. The improper lock ordering further compounds the issue as the code attempts to acquire tc_lock while holding cifs_swnreg_idr_mutex, which directly violates documented CIFS lock ordering requirements and creates potential deadlock scenarios or inconsistent state conditions. This violation of established locking protocols represents a classic anti-pattern that undermines the integrity of the entire subsystem's concurrency model.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable arbitrary code execution within the kernel context when exploited. Attackers could leverage this flaw to cause system instability, data corruption, or privilege escalation by triggering the use-after-free condition during witness notification processing. The vulnerability affects systems running Linux kernels with CIFS client support and particularly impacts environments where multiple connections to the same network share are common, such as enterprise file servers or clustered storage solutions. The fix addresses this by fundamentally changing how witness registrations store and reference connection information, shifting from a cached pointer approach to a stable identity-based system that ensures proper lifecycle management and prevents access to freed memory structures.
The proposed mitigation strategy involves restructuring the registration system to maintain only stable identifying information within the registration object itself, including the registration ID, network name, share name, and notification flags. When notifications arrive, the system now copies this stable identity information while holding the mutex lock, then performs a fresh lookup of currently active tcon instances using the standard cifs_tcp_ses_lock followed by tc_lock ordering protocol. This approach ensures that all operations reference live, valid tcon structures rather than potentially freed memory locations. The solution also modifies the registration and unregistration processes to use live tcon references provided by callers instead of cached pointers, eliminating the window where raw pointer access could occur between lock acquisition and release. Additionally, the final unregister send operation is now integrated into cifs_swn_unregister() while still protected by the mutex, ensuring proper cleanup sequence without exposing the registration to concurrent modification during critical sections.
This fix preserves the intended architectural behavior of one-registration/many-tcon mapping where a single registration ID represents a net/share pair while ensuring that notification handling operates on live representatives selected at runtime rather than cached instances. The implementation maintains the CLIENT_MOVE ordering requirements by ensuring that old-IP unregister messages are sent before new-IP register messages, preserving the expected sequence for connection migration scenarios. The solution aligns with established security practices and follows the principle of least privilege by eliminating unnecessary pointer caching that could lead to memory safety violations. This change represents a significant improvement over the previous implementation's approach to resource management and demonstrates proper adherence to kernel security best practices as outlined in various security standards including those related to memory safety and concurrent access control. The fix essentially transforms an unsafe pointer-based system into a safe, reference-counted approach that properly manages object lifecycles while maintaining backward compatibility with existing client behavior patterns.
The vulnerability classification aligns with CWE-416 Use After Free, which specifically addresses situations where freed memory is accessed, and potentially CWE-121 Heap Based Buffer Overflow when considering the broader implications of memory corruption. The fix approach also relates to ATT&CK technique T1059.005 Command and Scripting Interpreter: Visual Basic, though more directly to defensive measures against memory corruption attacks. The solution addresses fundamental concurrency issues that could be exploited in privilege escalation scenarios within kernel space, making it a critical vulnerability requiring immediate attention in production environments. The implementation demonstrates proper lock ordering practices and resource management principles that are essential for maintaining kernel stability and security across enterprise Linux deployments.