high 7.8

CVE-2026-64401 json

smb: client: resolve SWN tcon from live registrations

published 2026-07-25 3 mo ago modified 2026-10-19 20 d ago also EUVD-2026-48945

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

cifs_swn_notify() looks up a witness registration by id under cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a lifetime reference, and it is not a stable representative once cifs_get_swn_reg() lets multiple tcons for the same net/share name share one registration id.

A same-share second mount can keep the cifs_swn_reg alive after the first tcon unregisters and is freed. The registration then still points at the freed first tcon, so taking tc_lock or incrementing tc_count through swnreg->tcon only moves the use-after-free earlier. Taking tc_lock while holding cifs_swnreg_idr_mutex also violates the documented CIFS lock order.

Fix this by making the registration store only the stable witness identity: id, net name, share name, and notify flags. When a notify arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex, then find and pin a live witness tcon that currently matches the net/share pair under the normal cifs_tcp_ses_lock -> tc_lock order. The notification path uses that pinned tcon directly and drops the reference when done.

Registration and unregister messages now use the live tcon passed by the caller instead of a cached tcon in the registration. The final unregister send is folded into cifs_swn_unregister() while the registration is still protected by cifs_swnreg_idr_mutex. This removes the previous find/drop/reacquire raw-pointer window. The release path only removes the idr entry and frees the stable identity strings.

This preserves the intended one-registration/many-tcon behavior: a registration id represents a net/share pair, and notify handling acts on a live representative selected at use time. It also preserves CLIENT_MOVE ordering for the representative tcon because the old-IP unregister is sent before cifs_swn_register() sends the new-IP register.

Patch / fix

fixed in 1 distros 4 links 6

Linux Linux 6.1.178, 6.6.145, 6.12.97, 6.18.39, 7.1.4, 7.2

debian ubuntu suse opensuse

linux Debian 12 6.1.180-1
linux Debian 13 6.12.100-1
linux Debian 14 7.1.4-1
linux-6.12 Debian 12 6.12.100-1~deb12u1

debian advisories DEBIAN-CVE-2026-64401

linux Ubuntu 22.04 LTS 5.15.0-198.208
linux Ubuntu 24.04 LTS 6.8.0-147.147
linux Ubuntu 26.04 LTS 7.0.0-31.31
linux-aws Ubuntu 22.04 LTS 5.15.0-1117.124
linux-aws Ubuntu 24.04 LTS 6.8.0-1067.70
linux-aws Ubuntu 26.04 LTS 7.0.0-1012.12
linux-gcp Ubuntu 22.04 LTS 5.15.0-1118.128
linux-gcp Ubuntu 24.04 LTS 6.8.0-1071.79

ubuntu advisories UBUNTU-CVE-2026-64401

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1
kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.81.1
kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.81.1
kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1
kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1.150700.17.45.1

suse advisories SUSE-SU-2026:4254-1 SUSE-SU-2026:23887-1 SUSE-SU-2026:23902-1 SUSE-SU-2026:23897-1 SUSE-SU-2026:23881-1 SUSE-SU-2026:4120-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1

opensuse advisories openSUSE-SU-2026:21910-1 openSUSE-SU-2026:11476-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-64401 updated 2026-11-05 cvss 5.5

kernel: smb: client: resolve SWN tcon from live registrations

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-416 Use After Free

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-64401
NVD CVE-2026-64401

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary