CVE-2026-64140

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in Linux Kernel ksmbd

Publication date: 2026-07-19

Last updated on: 2026-08-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later). During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ... Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-18

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64140

EUVD

EUVD-2026-45825

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 7.0 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a null pointer dereference vulnerability in the Linux kernel's ksmbd implementation. When an SMB2 client opens a file with a durable v2 handle and then logs off, a file pointer remains registered in the system's global file table even after the session is cleared. This causes a kernel panic when reading /proc/fs/ksmbd/files because the code tries to access a null pointer without checking it first.

Detection Guidance

This vulnerability can be detected by checking for kernel panics or crashes when reading /proc/fs/ksmbd/files. Monitor system logs for general protection faults or null pointer dereference errors. Ensure ksmbd is enabled and configured with 'durable handles = yes'.

Impact Analysis

This vulnerability can cause a kernel panic, leading to system crashes and potential denial of service. It requires an attacker to have access to an SMB2 share with durable handles enabled, which could allow them to crash the system by triggering the specific sequence of operations.

Compliance Impact

This vulnerability causes a kernel panic when reading /proc/fs/ksmbd/files, which could lead to system instability or denial of service. Such disruptions may impact compliance with standards requiring availability (e.g., GDPR Article 32, HIPAA Security Rule).

Mitigation Strategies

Disable durable handles in ksmbd configuration by setting 'durable handles = no'. Update the Linux kernel to the latest patched version. Restrict access to /proc/fs/ksmbd/files to prevent unauthorized reads.

Hi! I’m here to help you understand CVE-2026-64140. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70