CVE-2026-64397— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 14
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 1426fd79102539bc0ab5c8fced047ad4313b9908 | affected |
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 2a64dbf9c739ddf7a25a066507597bf89f8f73d2 | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< 64dac2d486ec1eb18dc00968b16a230b6b75ec24 | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199 | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< fd22b039a5a05bc1d6818e9dcd1001fb432a829d | affected | ||
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9< be6d26bf27499977c746abc163659915082348d8 | affected | ||
5.15 | affected | ||
< 5.15 | unaffected | ||
| … +6 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-64397の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
ksmbd: serialize QUERY_DIRECTORY requests per file
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.15版本存在安全漏洞，该漏洞源于并发QUERY_DIRECTORY请求中指针覆盖导致栈释放后重用。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-64397の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-64397のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-64397 补丁与修复 (6)
Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total
| CVE-2026-64355 | 9.8 CRITICAL | bpf: Reject fragmented frames in devmap |
| CVE-2026-64410 | 9.8 CRITICAL | netfilter: flowtable: IPIP tunnel hardware offload is not yet support |
| CVE-2026-64399 | 9.8 CRITICAL | ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE |
| CVE-2026-64391 | 9.8 CRITICAL | ksmbd: use opener credentials for ADS I/O |
| CVE-2026-64387 | 9.8 CRITICAL | smb: client: fix query directory replay double-free |
| CVE-2026-64386 | 9.8 CRITICAL | smb: client: fix query_info() replay double-free |
| CVE-2026-64385 | 9.8 CRITICAL | smb: client: fix double-free in SMB2_ioctl() replay |
| CVE-2026-64383 | 9.8 CRITICAL | smb: client: fix double-free in SMB2_flush() replay |
| CVE-2026-64384 | 9.8 CRITICAL | smb: client: fix change notify replay double-free |
| CVE-2026-64268 | 9.8 CRITICAL | RDMA/siw: bound Read Response placement to the RREAD length |
| CVE-2026-64439 | 9.8 CRITICAL | crypto: krb5 - filter out async aead implementations at alloc |
| CVE-2026-64303 | 9.8 CRITICAL | spi: fsl-lpspi: terminate the RX channel on TX prepare failure path |
| CVE-2026-64459 | 9.8 CRITICAL | tcp: restore RCU grace period in tcp_ao_destroy_sock |
| CVE-2026-64523 | 9.8 CRITICAL | net/handshake: Take a long-lived file reference at submit |
| CVE-2026-64392 | 9.1 CRITICAL | ksmbd: use opener credentials for delete-on-close |
| CVE-2026-64319 | 9.1 CRITICAL | nvmet-auth: validate reply message payload bounds against transfer length |
| CVE-2026-64269 | 9.1 CRITICAL | RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg |
| CVE-2026-64450 | 9.1 CRITICAL | tipc: fix out-of-bounds read in broadcast Gap ACK blocks |
| CVE-2026-64393 | 9.1 CRITICAL | ksmbd: run set info with opener credentials |
| CVE-2026-64257 | 9.1 CRITICAL | smb: client: reject overlapping data areas in SMB2 responses |
Showing 20 of 274 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-64581
xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - CVE-2026-64580
xfrm6: clear dst.dev on error to avoid double netdev_put in - CVE-2026-64578
ksmbd: validate compound request size before reading Structu - CVE-2026-64579
xfrm: policy: preallocate inexact bins before xfrm_hash_rebu - CVE-2026-64576
nexthop: initialize extack in nh_res_bucket_migrate()
同じベンダー: Linux
- CVE-2026-64581
xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - CVE-2026-64580
xfrm6: clear dst.dev on error to avoid double netdev_put in - CVE-2026-64578
ksmbd: validate compound request size before reading Structu - CVE-2026-64579
xfrm: policy: preallocate inexact bins before xfrm_hash_rebu - CVE-2026-64576
nexthop: initialize extack in nh_res_bucket_migrate()
V. CVE-2026-64397へのコメント
まだコメントはありません