CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: serialize QUERY_DIRECTORY requests per file

smb2querydir() stores a pointer to its stack-allocated private data in

the ksmbdfile readdirdata. Concurrent QUERY_DIRECTORY requests using the

same file handle can overwrite this pointer while an iterate_dir() callback

is still using it, resulting in a stack use-after-free.

Add a per-file mutex and hold it while accessing the shared directory

enumeration state. The lock covers scan restart, dot entry state,

readdir_data setup and iteration, and response construction. This prevents

another request from replacing readdir_data.private before the current

request has finished using it and also serializes the shared file position.