CVE-2026-64141
Received Received - Intake

Null Pointer Dereference in ksmbd Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF. If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ... Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL. Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64141
EUVD
EUVD-2026-45826

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel ksmbd *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a null pointer dereference vulnerability in the Linux kernel's ksmbd module. It occurs during SMB2 session teardown and renewal. When a session is logged off but the TCP connection remains, stale lease information can cause a kernel panic when a new session is established with the same ClientGuid. The issue stems from improper cleanup of lease-related structures during session teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's ksmbd implementation and requires kernel-level detection. Monitor kernel logs for null pointer dereference errors or kernel panics related to ksmbd or SMB2 operations. Check for crashes during SMB2 session setup or file operations with durable handles enabled.

Impact Analysis

This vulnerability can cause a kernel panic, leading to system crashes and potential denial of service. It requires a specific configuration ('durable handles = yes') and involves SMB2 protocol operations. Attackers on the same network could exploit this to crash vulnerable systems.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux ksmbd implementation that causes a null pointer dereference and kernel panic. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, access controls, and auditability rather than kernel stability or SMB protocol implementation flaws.

Mitigation Strategies

Apply the latest kernel patches that address this issue. Disable durable handles in ksmbd configuration if not required. Restrict SMB2 session setup and file operations to trusted clients until patched. Monitor for unusual kernel crashes or SMB-related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart