CVE-2026-64397
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In the Linux kernel, the ksmbd filesystem has a concurrency issue with directory queries. Concurrent QUERY_DIRECTORY requests for the same file handle can overwrite a stack pointer, leading to a use-after-free.
Risk Assessment
An attacker can exploit this vulnerability to cause system instability or potentially escalate privileges via memory corruption.
Recommendation
Apply the Linux kernel patch that adds a per-file mutex to serialize QUERY_DIRECTORY requests.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.