CVE-2026-64401: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64401 Overview

CVE-2026-64401 is a use-after-free vulnerability in the Linux kernel's SMB (Server Message Block) client witness (SWN) subsystem. The flaw exists in cifs_swn_notify(), which looks up a witness registration by identifier under cifs_swnreg_idr_mutex, drops the mutex, and then dereferences a cached tcon pointer that is not a stable lifetime reference. When multiple tree connections share a single registration, a second mount can keep cifs_swn_reg alive after the original tcon is freed, leaving the registration pointing at released memory.

Critical Impact
A local attacker with SMB mount privileges can trigger memory corruption in the kernel, leading to privilege escalation, information disclosure, or denial of service.

Affected Products

Linux kernel versions containing the smb/client witness notification code prior to the fix commits
Distributions shipping the affected CIFS client with SWN support
Systems mounting SMB shares using witness protocol for continuous availability

Discovery Timeline

2026-07-25 - CVE-2026-64401 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64401

Vulnerability Analysis

The vulnerability resides in the CIFS client witness notification path. The cifs_get_swn_reg() function allows multiple tcon structures targeting the same net/share name pair to share one witness registration identifier. This design implements a one-registration/many-tcon model, but the registration structure caches a raw pointer to only one of those tcons.

When cifs_swn_notify() receives a notification, it acquires cifs_swnreg_idr_mutex, resolves the registration by id, drops the mutex, and then operates on the cached swnreg->tcon pointer. If the first tcon has unregistered and been freed while a second mount keeps the registration alive, the cached pointer references released kernel memory. Attempts to take tc_lock or increment tc_count through the stale pointer manifest the use-after-free.

Additionally, taking tc_lock while holding cifs_swnreg_idr_mutex violates the documented CIFS lock ordering, introducing a secondary correctness issue that could lead to deadlock under contention.

Root Cause

The root cause is a lifetime mismatch between the shared witness registration and the cached tcon pointer it stores. The registration does not hold a reference on the tcon, and the cached pointer is not updated when the representative tcon is destroyed. The fix restructures the registration to store only stable identity fields — id, net name, share name, and notify flags — and resolves a live tcon under the correct lock order (cifs_tcp_ses_lock then tc_lock) at notification time.

Attack Vector

Exploitation requires local access with the ability to mount SMB shares that use the witness protocol. An attacker orchestrates concurrent mount and unmount operations against the same net/share pair to race the registration lifecycle against tcon teardown. A witness notification arriving during the race window triggers the dereference of the freed tcon. The vulnerability is not remotely exploitable without prior local access to initiate SMB mounts.

The kernel fix is distributed across multiple stable commits including 0700f946659d and 51d18db392e5. See the kernel fix commits for the full patch series describing the redesigned registration lifecycle.

Detection Methods for CVE-2026-64401

Indicators of Compromise

Kernel oops or panic messages referencing cifs_swn_notify, cifs_swn_register, or cifs_swn_unregister in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the fs/smb/client subtree
Unexpected termination of CIFS-mounted workloads coinciding with SMB server failover or IP change events

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during SMB failover fuzzing
Audit installed kernel packages against the fix commits listed in the vendor advisories
Correlate CIFS mount/unmount events with witness notification traffic to identify race-prone workloads

Monitoring Recommendations

Collect kernel logs centrally and alert on stack traces containing cifs_swn_ symbols
Monitor for repeated SMB reconnect or CLIENT_MOVE witness events that could be leveraged to drive the race
Track kernel versions across the fleet and flag hosts running unpatched CIFS clients with SWN enabled

How to Mitigate CVE-2026-64401

Immediate Actions Required

Apply the kernel updates from your distribution containing the SWN registration lifecycle fixes
Inventory hosts that mount SMB shares with the witness protocol and prioritize them for patching
Restrict local mount capabilities on multi-tenant systems until the patched kernel is deployed

Patch Information

The fix is available in the mainline Linux kernel and backported across stable branches. Relevant commits include 0700f946659d, 51d18db392e5, 91b8a58c6ac1, 945b4a4a5449, aa3c0cab4b28, and ec457f9afe5a. The patch stores only stable identity data in the registration and pins a live tcon under the correct lock order before use.

Workarounds

Avoid using the witness protocol by mounting SMB shares without the witness mount option where continuous availability is not required
Prevent concurrent same-share mounts from untrusted local users through mount namespace and capability restrictions
Disable SMB mounting for unprivileged users where the CIFS client is not operationally required

bash

# Verify running kernel version and check for the fix
uname -r

# Mount SMB share without witness protocol as a temporary mitigation
mount -t cifs //server/share /mnt/point -o username=user,vers=3.0

# Restrict unprivileged mount capability
sysctl -w kernel.unprivileged_userns_clone=0