CVE-2026-64397: ksmbd: serialize QUERY_DIRECTORY requests per file

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: serialize QUERY_DIRECTORY requests per file

smb2_query_dir() stores a pointer to its stack-allocated private data in
the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the
same file handle can overwrite this pointer while an iterate_dir() callback
is still using it, resulting in a stack use-after-free.

Add a per-file mutex and hold it while accessing the shared directory
enumeration state. The lock covers scan restart, dot entry state,
readdir_data setup and iteration, and response construction. This prevents
another request from replacing readdir_data.private before the current
request has finished using it and also serializes the shared file position.

The Linux kernel CVE team has assigned CVE-2026-64397 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.178 with commit 1426fd79102539bc0ab5c8fced047ad4313b9908
	Fixed in 6.6.145 with commit 2a64dbf9c739ddf7a25a066507597bf89f8f73d2
	Fixed in 6.12.96 with commit 64dac2d486ec1eb18dc00968b16a230b6b75ec24
	Fixed in 6.18.39 with commit a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199
	Fixed in 7.1.4 with commit fd22b039a5a05bc1d6818e9dcd1001fb432a829d
	Fixed in 7.2-rc1 with commit be6d26bf27499977c746abc163659915082348d8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64397
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/smb2pdu.c
	fs/smb/server/vfs_cache.c
	fs/smb/server/vfs_cache.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908
	https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2
	https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24
	https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199
	https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d
	https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8