Executive brief
A vulnerability has been identified in the Linux kernel's ksmbd component, which provides SMB file sharing services. This flaw allows a remote attacker to potentially crash the system or cause unpredictable behavior by sending specific, simultaneous requests to view directory contents. The issue has been resolved in recent kernel updates by ensuring these requests are processed one at a time.
Technical details
A stack use-after-free vulnerability exists in the ksmbd component of the Linux kernel within the smb2_query_dir() function. The function stores a pointer to stack-allocated private data in the ksmbd_file readdir_data structure; however, concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still active. This race condition allows a subsequent request to replace the private data before the initial request completes. The fix introduces a per-file mutex (readdir_lock) to serialize directory enumeration state access, covering scan restarts, entry state, and response construction. Patches are available in various stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4.
Affected products
- Linux Linux Kernel 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-06-12: other: Vulnerability fix authored
- 2026-07-24: patched: Fix committed to stable kernel tree
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908
- https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2
- https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24
- https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199
- https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8
- https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d