{"cve":"CVE-2026-64401","nvd":{"published":"2026-07-25T10:17:23.610","modified":"2026-10-19T21:17:35.580","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: resolve SWN tcon from live registrations\n\ncifs_swn_notify() looks up a witness registration by id under\ncifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's\ncached tcon pointer.  That pointer is not a lifetime reference, and it is\nnot a stable representative once cifs_get_swn_reg() lets multiple tcons\nfor the same net/share name share one registration id.\n\nA same-share second mount can keep the cifs_swn_reg alive after the first\ntcon unregisters and is freed.  The registration then still points at the\nfreed first tcon, so taking tc_lock or incrementing tc_count through\nswnreg->tcon only moves the use-after-free earlier.  Taking tc_lock while\nholding cifs_swnreg_idr_mutex also violates the documented CIFS lock\norder.\n\nFix this by making the registration store only the stable witness\nidentity: id, net name, share name, and notify flags.  When a notify\narrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,\nthen find and pin a live witness tcon that currently matches the net/share\npair under the normal cifs_tcp_ses_lock -> tc_lock order.  The notification\npath uses that pinned tcon directly and drops the reference when done.\n\nRegistration and unregister messages now use the live tcon passed by the\ncaller instead of a cached tcon in the registration.  The final unregister\nsend is folded into cifs_swn_unregister() while the registration is still\nprotected by cifs_swnreg_idr_mutex.  This removes the previous\nfind/drop/reacquire raw-pointer window.  The release path only removes the\nidr entry and frees the stable identity strings.\n\nThis preserves the intended one-registration/many-tcon behavior: a\nregistration id represents a net/share pair, and notify handling acts on a\nlive representative selected at use time.  It also preserves CLIENT_MOVE\nordering for the representative tcon because the old-IP unregister is sent\nbefore cifs_swn_register() sends the new-IP register.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7","https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c","https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7","https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21","https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-64401","score":0.00126,"percentile":0.02278,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}