CVE-2026-64140
Received Received - Intake

Null Pointer Dereference in Linux Kernel ksmbd

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later). During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ... Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64140
EUVD
EUVD-2026-45825

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a null pointer dereference vulnerability in the Linux kernel's ksmbd implementation. When an SMB2 client opens a file with a durable v2 handle and then logs off, a file pointer remains registered in the system's global file table even after the session is cleared. This causes a kernel panic when reading /proc/fs/ksmbd/files because the code tries to access a null pointer without checking it first.

Detection Guidance

This vulnerability can be detected by checking for kernel panics or crashes when reading /proc/fs/ksmbd/files. Monitor system logs for general protection faults or null pointer dereference errors. Ensure ksmbd is enabled and configured with 'durable handles = yes'.

Impact Analysis

This vulnerability can cause a kernel panic, leading to system crashes and potential denial of service. It requires an attacker to have access to an SMB2 share with durable handles enabled, which could allow them to crash the system by triggering the specific sequence of operations.

Compliance Impact

This vulnerability causes a kernel panic when reading /proc/fs/ksmbd/files, which could lead to system instability or denial of service. Such disruptions may impact compliance with standards requiring availability (e.g., GDPR Article 32, HIPAA Security Rule).

Mitigation Strategies

Disable durable handles in ksmbd configuration by setting 'durable handles = no'. Update the Linux kernel to the latest patched version. Restrict access to /proc/fs/ksmbd/files to prevent unauthorized reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64140. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart