CVE-2026-64397: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64397 Overview

CVE-2026-64397 is a stack use-after-free vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in smb2_query_dir(), which stores a pointer to stack-allocated private data in the ksmbd_filereaddir_data structure. Concurrent QUERY_DIRECTORY requests targeting the same file handle can overwrite this pointer while an iterate_dir() callback is still dereferencing it. The result is a stack use-after-free reachable over the network from any SMB client able to open a directory handle.

Critical Impact
A remote attacker who can issue concurrent SMB QUERY_DIRECTORY requests against a shared file handle can trigger a kernel stack use-after-free, enabling denial of service or potential kernel-level code execution.

Affected Products

Linux kernel builds shipping the ksmbd SMB server module prior to the fixing commits
Distributions and appliances exposing ksmbd file shares over SMB2/SMB3
Storage and NAS products embedding vulnerable Linux kernel versions with ksmbd enabled

Discovery Timeline

2026-07-25 - CVE-2026-64397 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64397

Vulnerability Analysis

The ksmbd module implements an in-kernel SMB3 file server. When a client sends an SMB2 QUERY_DIRECTORY request, smb2_query_dir() allocates a private data structure on its kernel stack and stores a pointer to that structure in the shared ksmbd_file->readdir_data.private field. The kernel's iterate_dir() helper then invokes a filldir-style callback that reads from readdir_data.private during directory enumeration.

Because readdir_data is per-file rather than per-request, two concurrent QUERY_DIRECTORY operations using the same file handle race against each other. A second request can overwrite readdir_data.private with its own stack pointer while the first request's callback is still executing. When the first request later returns from smb2_query_dir(), its stack frame is torn down, but the pointer remains reachable, producing a classic stack use-after-free.

Root Cause

The root cause is missing serialization around a per-file shared enumeration state. smb2_query_dir() treated readdir_data as private to the current request while it was in fact shared across all clients holding the same file handle. There was no lock protecting scan restart, dot entry state, readdir_data setup, iteration, or response construction.

Attack Vector

Exploitation requires network access to an SMB share exported by ksmbd and the ability to open a directory handle. An attacker opens a directory, then issues overlapping QUERY_DIRECTORY requests on the same file ID from multiple SMB compound operations or parallel connections sharing the handle. Winning the race corrupts the callback's view of stack memory, producing a kernel crash or, with careful stack grooming, controlled memory access. No authentication decorations beyond a valid SMB session are required by the code path itself.

No public proof-of-concept exploit is currently available. See the upstream fix commit for the corrected locking behavior.

Detection Methods for CVE-2026-64397

Indicators of Compromise

Kernel oops or panic messages referencing smb2_query_dir, iterate_dir, or ksmbd_readdir in dmesg or /var/log/kern.log
KASAN reports flagging stack-out-of-bounds or use-after-free within ksmbd call stacks
Unexpected ksmbd worker thread crashes correlated with active SMB client sessions

Detection Strategies

Enable KASAN on test kernels running ksmbd to surface use-after-free access during fuzzing or heavy client load
Monitor for repeated SMB QUERY_DIRECTORY requests reusing the same FileId from multiple concurrent tree connects
Alert on kernel crash telemetry from Linux SMB servers, particularly stack traces that include ksmbd_vfs_readdir or smb2_query_dir

Monitoring Recommendations

Forward kernel logs from ksmbd hosts to a centralized logging pipeline for stack-trace analysis
Track SMB session anomalies such as duplicate QUERY_DIRECTORY operations against a single handle from distinct client channels
Baseline ksmbd worker CPU and crash frequency to detect exploitation attempts that trigger kernel faults

How to Mitigate CVE-2026-64397

Immediate Actions Required

Update Linux kernels to versions containing the ksmbd: serialize QUERY_DIRECTORY requests per file fix from the stable tree
Restrict ksmbd share exposure to trusted network segments using host or network firewalls
Disable the ksmbd module on systems where it is not required using modprobe -r ksmbd and blacklisting the module

Patch Information

The fix adds a per-file mutex that is held across scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents a second request from replacing readdir_data.private before the first request finishes and serializes access to the shared file position. Fix commits are available in the stable kernel tree, including 1426fd79, 2a64dbf9, 64dac2d4, a1d5d31c, be6d26bf, and fd22b039.

Workarounds

Stop the ksmbd.service and switch to a user-space SMB server such as Samba until patched kernels are deployed
Limit SMB access to authenticated clients only and disable guest access on ksmbd shares
Apply firewall rules restricting inbound TCP/445 to known management subnets to reduce the attack surface

bash

# Disable and blacklist the ksmbd module until the kernel is patched
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf