CVE-2026-64401: smb: client: resolve SWN tcon from live registrations

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

smb: client: resolve SWN tcon from live registrations

cifs_swn_notify() looks up a witness registration by id under
cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's
cached tcon pointer.  That pointer is not a lifetime reference, and it is
not a stable representative once cifs_get_swn_reg() lets multiple tcons
for the same net/share name share one registration id.

A same-share second mount can keep the cifs_swn_reg alive after the first
tcon unregisters and is freed.  The registration then still points at the
freed first tcon, so taking tc_lock or incrementing tc_count through
swnreg->tcon only moves the use-after-free earlier.  Taking tc_lock while
holding cifs_swnreg_idr_mutex also violates the documented CIFS lock
order.

Fix this by making the registration store only the stable witness
identity: id, net name, share name, and notify flags.  When a notify
arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,
then find and pin a live witness tcon that currently matches the net/share
pair under the normal cifs_tcp_ses_lock -> tc_lock order.  The notification
path uses that pinned tcon directly and drops the reference when done.

Registration and unregister messages now use the live tcon passed by the
caller instead of a cached tcon in the registration.  The final unregister
send is folded into cifs_swn_unregister() while the registration is still
protected by cifs_swnreg_idr_mutex.  This removes the previous
find/drop/reacquire raw-pointer window.  The release path only removes the
idr entry and frees the stable identity strings.

This preserves the intended one-registration/many-tcon behavior: a
registration id represents a net/share pair, and notify handling acts on a
live representative selected at use time.  It also preserves CLIENT_MOVE
ordering for the representative tcon because the old-IP unregister is sent
before cifs_swn_register() sends the new-IP register.

The Linux kernel CVE team has assigned CVE-2026-64401 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.1.178 with commit 51d18db392e5386a7bb9e816d611f14e600cca3c
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.6.145 with commit aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.12.97 with commit 945b4a4a54497db1dcb2f20ef801a84e884dac21
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 6.18.39 with commit 91b8a58c6ac15c7db6518f696389933282f88da7
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 7.1.4 with commit 0700f946659d0ab2352ec8a9b1c6fc74b13a27d7
	Issue introduced in 5.11 with commit fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 and fixed in 7.2-rc1 with commit ec457f9afe5ae9538bdcd58fd4cb442b9787e183

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64401
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/cifs_swn.c
	fs/smb/client/trace.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c
	https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd
	https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21
	https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7
	https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7
	https://git.kernel.org/stable/c/ec457f9afe5ae9538bdcd58fd4cb442b9787e183