CVEFinder.io

CVE-2026-64397

⛔ critical
🔍 Scan for this CVE
Summary

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: serialize QUERY_DIRECTORY requests per file

smb2_query_dir() stores a pointer to its stack-allocated private data in
the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the
same file handle can overwrite this pointer while an iterate_dir() callback
is still using it, resulting in a stack use-after-free.

Add a per-file mutex and hold it while accessing the shared directory
enumeration state. The lock covers scan restart, dot entry state,
readdir_data setup and iteration, and response construction. This prevents
another request from replacing readdir_data.private before the current
request has finished using it and also serializes the shared file position.

CVSS Score
9.8
Critical
EPSS Score
0.5
Exploit Probability
Published Date
2026-07-25
First Seen: 2026-07-31
📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.5% of all 340,405 vulnerabilities in our database.

#32,269
Top 10% most severe
Severity Percentile
Last Modified 2026-07-27
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

📦 Affected Products 0

No affected products information available

🔗 References 6