CVE-2026-64401

What it actually does

This is a Linux kernel SMB/CIFS client use-after-free in the Server Witness Notification handling path. A witness registration can retain a stale tree connection pointer after one SMB share mount is unregistered and freed while another mount of the same share keeps the registration object alive. When a witness notification is later processed, the kernel may dereference or lock the freed connection object, causing memory corruption. Depending on heap state and attacker control, impact can range from kernel crash to local privilege escalation with kernel-level code execution. The CVSS vector indicates local access with low attack complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Systems that mount SMB/CIFS shares from Linux can be destabilized or potentially fully compromised by a local user or process able to trigger the vulnerable mount and notification sequence. Successful exploitation could allow an attacker to gain elevated privileges, tamper with data, disable workloads through kernel crashes, or use the compromised host as a foothold for further lateral movement. It is not currently listed in CISA KEV, is not reported as ransomware-used, and has a low EPSS score, so broad internet-scale exploitation is unlikely; however, kernel-level local privilege escalation remains high impact for multi-user servers, build systems, VDI, file-transfer hosts, and environments where SMB mounts are automated or delegated.

How an attack unfolds

An attacker first obtains local execution on a Linux system that uses the in-kernel SMB/CIFS client. They then create or influence multiple CIFS mounts that reference the same SMB network/share identity so those mounts share one witness registration. The attacker causes the first tree connection to unregister and be freed while a second mount keeps the witness registration alive. A subsequent witness notification, typically influenced through SMB server behavior or network/share state changes, causes the kernel notification handler to use the stale cached connection pointer. That use-after-free can crash the kernel or, with careful heap shaping, corrupt kernel memory in a way that elevates the attacker from a low-privileged local context to kernel-level control. No public mature exploit is indicated in the supplied data.

How to fix it

Upgrade to a Linux kernel or vendor kernel package that includes the upstream fix described as "smb: client: resolve SWN tcon from live registrations." No exact fixed package versions were provided, so use distribution advisories and kernel changelogs to identify the first fixed build for each affected platform. Reboot after installing the fixed kernel, because kernel updates are not effective until the running kernel is replaced. Where immediate patching is not possible, reduce exposure by disabling or avoiding CIFS/SMB client mounts on systems that do not require them, unloading or blacklisting the cifs module where feasible, restricting who can run mount.cifs or trigger automated SMB mounts, reviewing sudo/autofs/systemd mount delegation, limiting unprivileged mount pathways, and blocking outbound SMB traffic to untrusted servers. These mitigations reduce exploitability but should not be considered complete substitutes for the kernel fix.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version, not only the installed package version, using standard OS tooling such as uname and distribution package queries. Check the vendor changelog or source package for the fix text "smb: client: resolve SWN tcon from live registrations" or equivalent CIFS/SWN lifetime-reference changes. Verify the host has been rebooted into the fixed kernel. To assess exposure, check whether the cifs module is loaded, whether CIFS mounts are present, and whether SMB mounts are created through fstab, systemd mount units, autofs, scripts, containers, or privileged helper workflows. For mitigations, confirm that nonessential CIFS mounts no longer exist, mount delegation is restricted, and outbound SMB is limited to trusted destinations. Avoid running untrusted proof-of-concept code on production systems because exploitation targets kernel memory safety.

Typical attack path

1. Gain low-privileged local code execution on a Linux host that can use or influence SMB/CIFS mounts.
2. Identify that the CIFS client and Server Witness Notification path are available or in use.
3. Create, trigger, or race multiple mounts to the same SMB net/share identity so a witness registration is shared across tree connections.
4. Unmount or force teardown of one connection so its tcon object is freed while the shared witness registration remains alive.
5. Trigger a witness notification for that registration so the kernel dereferences the stale cached tcon pointer.
6. Use the resulting memory corruption to crash the host or attempt local privilege escalation.
7. If privilege escalation succeeds, install persistence, access protected data, or move laterally using the compromised host’s credentials and network reachability.

How to detect it

There are no reliable network-only indicators that prove exploitation because the vulnerable behavior occurs inside the Linux kernel SMB/CIFS client and may look like ordinary SMB mount activity. Review kernel logs, journalctl output, dmesg history, crash dumps, kdump/vmcore data, audit logs, sudo logs, shell history, EDR telemetry, and process execution logs. Look for kernel oops, BUG, general protection fault, panic, slab corruption, KASAN, or use-after-free messages with stack frames referencing CIFS/SMB witness functions such as cifs_swn_notify, cifs_swn_unregister, cifs_get_swn_reg, cifs_put_tcon, or related CIFS tree-connection locking. Correlate those events with repeated mount.cifs activity, multiple mounts to the same SMB share, rapid mount/unmount cycles, autofs triggers, systemd mount restarts, or SMB connections to untrusted servers. If a crash occurred, preserve vmcore and kernel logs and perform forensic analysis for post-crash privilege escalation signs such as new privileged accounts, modified sudoers files, unexpected setuid binaries, suspicious kernel modules, credential access, or persistence. Absence of these artifacts does not rule out exploitation, especially if logs were lost during a crash or the attacker achieved controlled memory corruption without an oops.

• cifs_swn_notify
• cifs_swn_unregister
• cifs_get_swn_reg
• smb: client: resolve SWN tcon from live registrations
• mount.cifs
• type=cifs
• CIFS: VFS
• Status code returned 0xc000
• general protection fault
• BUG: KASAN: use-after-free
• BUG: unable to handle kernel NULL pointer dereference
• kernel panic
• Oops:
• /sbin/mount.cifs
• /usr/sbin/mount.cifs
• /proc/fs/cifs/DebugData
• /proc/fs/cifs/Stats

What your security team should do

• Prioritize patching Linux systems that mount SMB/CIFS shares, especially shared multi-user systems, build infrastructure, VDI hosts, file-transfer servers, and hosts where users or jobs can influence mounts.
• Inventory active CIFS usage by searching for loaded cifs modules, mounted cifs filesystems, fstab entries, systemd mount units, autofs maps, and scripts invoking mount.cifs.
• Apply the vendor-fixed kernel and reboot; track remediation by running kernel version rather than package installation alone.
• Temporarily restrict mount.cifs execution, sudo rules, autofs triggers, and other delegated mount paths until affected systems are patched.
• Limit outbound SMB access to trusted file servers and investigate SMB connections to unknown or user-controlled servers.
• Collect kernel logs and crash dumps from exposed systems before rebooting where compromise is suspected.
• Monitor for kernel oops/panic events involving CIFS/SWN functions and for unusual repeated CIFS mount/unmount activity by low-privileged users or automation.
• Because this is not currently KEV-listed and has low EPSS, balance urgency against exposure, but treat confirmed CIFS-client servers as high priority due to possible kernel-level impact.