CVE-2026-64397

Analyzed Analyzed - Analysis Complete

ksmbd Directory Traversal via Stack Use-After-Free

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64397

EUVD

EUVD-2026-48941

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.15 (inc) to 6.1.178 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a stack use-after-free vulnerability in the Linux kernel's ksmbd implementation. It occurs when concurrent QUERY_DIRECTORY requests using the same file handle overwrite a pointer to stack-allocated data while another request is still using it. The issue arises because smb2_query_dir() stores a pointer to its private data in the ksmbd_file structure, which can be corrupted by another request.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level detection. There are no direct network or system commands to detect it as it is a race condition in the kernel code. Monitoring for crashes or memory corruption in ksmbd-related processes may indicate exploitation attempts.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, escalate privileges, or cause a denial of service on systems running vulnerable versions of the Linux kernel with ksmbd enabled. It may lead to system crashes or unauthorized access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the ksmbd SMB server implementation. Compliance impacts would only occur if exploitation led to unauthorized data access or service disruption, which is not specified in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the ksmbd module to prevent potential exploitation until the update is applied.

Hi! I’m here to help you understand CVE-2026-64397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70