smb: client: resolve SWN tcon from live registrations
In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witness registration by id under cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a lifetime reference, and it is not a stable representative once cifs_get_swn_reg() lets multiple tcons for the same net/share name share one registration id. A same-share second mount can keep the cifs_swn_reg alive after the first tcon unregisters and is freed. The registration then still points at the freed first tcon, so taking tc_lock or incrementing tc_count through swnreg->tcon only moves the use-after-free earlier. Taking tc_lock while holding cifs_swnreg_idr_mutex also violates the documented CIFS lock order. Fix this by making the registration store only the stable witness identity: id, net name, share name, and notify flags. When a notify arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex, then find and pin a live witness tcon that currently matches the net/share pair under the normal cifs_tcp_ses_lock -> tc_lock order. The notification path uses that pinned tcon directly and drops the reference when done. Registration and unregister messages now use the live tcon passed by the caller instead of a cached tcon in the registration. The final unregister send is folded into cifs_swn_unregister() while the registration is still protected by cifs_swnreg_idr_
CVE-2026-64401
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64401
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"lessThan": "51d18db392e5386a7bb9e816d611f14e600cca3c",
"versionType": "git"
},
{
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"lessThan": "aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd",
"versionType": "git"
},
{
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"lessThan": "945b4a4a54497db1dcb2f20ef801a84e884dac21",
"versionType": "git"
},
{
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"lessThan": "91b8a58c6ac15c7db6518f696389933282f88da7",
"versionType": "git"
},
{
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"lessThan": "0700f946659d0ab2352ec8a9b1c6fc74b13a27d7",
"versionType": "git"
},
{
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"lessThan": "ec457f9afe5ae9538bdcd58fd4cb442b9787e183",
"versionType": "git"
}
],
"programFiles": [
"fs/smb/client/cifs_swn.c",
"fs/smb/client/trace.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/client/cifs_swn.c",
"fs/smb/client/trace.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64401
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41030 · Revision 1
- Added to Heist Feed
- Publisher date