Use-after-free in Linux kernel - CVE-2026-64397
Published: July 27, 2026
Vulnerability identifier: #VU139567
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64397
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in smb2_query_dir() and the ksmbd directory enumeration state when handling concurrent QUERY_DIRECTORY requests using the same file handle. A remote user can send concurrent QUERY_DIRECTORY requests on the same file handle to cause a denial of service.
The issue occurs because a pointer to stack-allocated private data is stored in shared readdir state and can be overwritten while an iterate_dir() callback is still using it.
Affected software
Linux kernel
How to mitigate CVE-2026-64397
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908
- https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2
- https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24
- https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199
- https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8
- https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d