CVE-2026-64401

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: resolve SWN tcon from live registrations

cifs_swn_notify() looks up a witness registration by id under

cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's

cached tcon pointer. That pointer is not a lifetime reference, and it is

not a stable representative once cifs_get_swn_reg() lets multiple tcons

for the same net/share name share one registration id.

A same-share second mount can keep the cifs_swn_reg alive after the first

tcon unregisters and is freed. The registration then still points at the

freed first tcon, so taking tc_lock or incrementing tc_count through

swnreg->tcon only moves the use-after-free earlier. Taking tc_lock while

holding cifs_swnreg_idr_mutex also violates the documented CIFS lock

order.

Fix this by making the registration store only the stable witness

identity: id, net name, share name, and notify flags. When a notify

arrives, copy that identity under ci

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References