CVE-2026-64401

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the SMB client. The cifs swn notify() function retrieves a witness registration by ID using the cifs swnreg idr mutex mutex, releases the mutex, and subsequently utilizes a cached tcon pointer. Because this pointer is not a lifetime reference, a second mount of the same share can keep the registration alive after the first tcon is unregistered and freed. Consequently, accessing tc lock or incrementing tc count via swnreg->tcon leads to a use-after-free condition. Additionally, acquiring tc lock while holding cifs swnreg idr mutex violates the established CIFS lock order.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.