CVE-2026-64401

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: resolve SWN tcon from live registrations<br /> <br /> cifs_swn_notify() looks up a witness registration by id under<br /> cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration&amp;#39;s<br /> cached tcon pointer. That pointer is not a lifetime reference, and it is<br /> not a stable representative once cifs_get_swn_reg() lets multiple tcons<br /> for the same net/share name share one registration id.<br /> <br /> A same-share second mount can keep the cifs_swn_reg alive after the first<br /> tcon unregisters and is freed. The registration then still points at the<br /> freed first tcon, so taking tc_lock or incrementing tc_count through<br /> swnreg-&gt;tcon only moves the use-after-free earlier. Taking tc_lock while<br /> holding cifs_swnreg_idr_mutex also violates the documented CIFS lock<br /> order.<br /> <br /> Fix this by making the registration store only the stable witness<br /> identity: id, net name, share name, and notify flags. When a notify<br /> arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,<br /> then find and pin a live witness tcon that currently matches the net/share<br /> pair under the normal cifs_tcp_ses_lock -&gt; tc_lock order. The notification<br /> path uses that pinned tcon directly and drops the reference when done.<br /> <br /> Registration and unregister messages now use the live tcon passed by the<br /> caller instead of a cached tcon in the registration. The final unregister<br /> send is folded into cifs_swn_unregister() while the registration is still<br /> protected by cifs_swnreg_idr_mutex. This removes the previous<br /> find/drop/reacquire raw-pointer window. The release path only removes the<br /> idr entry and frees the stable identity strings.<br /> <br /> This preserves the intended one-registration/many-tcon behavior: a<br /> registration id represents a net/share pair, and notify handling acts on a<br /> live representative selected at use time. It also preserves CLIENT_MOVE<br /> ordering for the representative tcon because the old-IP unregister is sent<br /> before cifs_swn_register() sends the new-IP register.