CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: serialize QUERY_DIRECTORY requests per file<br /> <br /> smb2_query_dir() stores a pointer to its stack-allocated private data in<br /> the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the<br /> same file handle can overwrite this pointer while an iterate_dir() callback<br /> is still using it, resulting in a stack use-after-free.<br /> <br /> Add a per-file mutex and hold it while accessing the shared directory<br /> enumeration state. The lock covers scan restart, dot entry state,<br /> readdir_data setup and iteration, and response construction. This prevents<br /> another request from replacing readdir_data.private before the current<br /> request has finished using it and also serializes the shared file position.