CVE-2026-64140

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference in proc_show_files()

When a SMB2 client opens a file with a durable v2 handle and then issues

SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the

reconnectable file pointer but leaves the fp registered in global_ft.idr

until the durable scavenger fires (up to fp->durable_timeout seconds

later).

During that window any read of /proc/fs/ksmbd/files (mode 0400) panics

the kernel because proc_show_files() walks global_ft.idr and

unconditionally dereferences fp->tcon->id with no NULL guard.

Reproducer requires only a successful SMB2 SESSION_SETUP and a share

configured with 'durable handles = yes'. KASAN report on mainline

70390501d194:

general protection fault, probably for non-canonical address

0xdffffc0000000000: 0000 [#1] SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:proc_show_files+0x118/0x740

Call Trace

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References