In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client… (CVE-2026-64140)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later). During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ... Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel ksmbd module involves a null pointer dereference in the proc_show_files() function. When an SMB2 client uses durable v2 handles and logs off, the session_fd_check() function clears the tcon pointer on the reconnectable file pointer but does not remove the file pointer from the global_ft.idr structure immediately. If /proc/fs/ksmbd/files is read during this interval, proc_show_files() dereferences fp->tcon->id without checking for NULL, causing a kernel panic. The fix adds a NULL guard to prevent the dereference and reports the tree id as 0 for durable-disconnected file pointers.
Potential Impact
A local user or process with access to the SMB2 share and the ability to read /proc/fs/ksmbd/files can trigger a kernel panic, resulting in a denial of service (system crash). There is no indication of privilege escalation or code execution from this vulnerability.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add a NULL pointer check in proc_show_files(), preventing the kernel panic. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client… (CVE-2026-64140)
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later). During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ... Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel ksmbd module involves a null pointer dereference in the proc_show_files() function. When an SMB2 client uses durable v2 handles and logs off, the session_fd_check() function clears the tcon pointer on the reconnectable file pointer but does not remove the file pointer from the global_ft.idr structure immediately. If /proc/fs/ksmbd/files is read during this interval, proc_show_files() dereferences fp->tcon->id without checking for NULL, causing a kernel panic. The fix adds a NULL guard to prevent the dereference and reports the tree id as 0 for durable-disconnected file pointers.
Potential Impact
A local user or process with access to the SMB2 share and the ability to read /proc/fs/ksmbd/files can trigger a kernel panic, resulting in a denial of service (system crash). There is no indication of privilege escalation or code execution from this vulnerability.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add a NULL pointer check in proc_show_files(), preventing the kernel panic. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3wf5-rcm5-gfqq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64140"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912b229
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:46:30 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.