CVE-2026-64140: ksmbd: fix null pointer dereference in proc_show_files()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in procshowfiles()
When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSIONLOGOFF, sessionfdcheck() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in globalft.idr until the durable scavenger fires (up to fp->durabletimeout seconds later).
During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because procshowfiles() walks globalft.idr and unconditionally dereferences fp->tcon->id with no NULL guard.
Reproducer requires only a successful SMB2 SESSIONSETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:procshowfiles+0x118/0x740 Call Trace: procshowfiles+0x118/0x740 seqreaditer+0x4ef/0xe10 procregreaditer+0x1b7/0x280 ...
Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64140?
The severity of CVE-2026-64140 is rated high with a CVSS score of 7.5.
How do I fix CVE-2026-64140?
To fix CVE-2026-64140, you should update to the latest patched version of the Linux kernel where the vulnerability is resolved.
What type of vulnerability is CVE-2026-64140?
CVE-2026-64140 is classified as a null pointer dereference vulnerability.
What impact does CVE-2026-64140 have on my system?
CVE-2026-64140 can lead to a denial of service condition due to the null pointer dereference in the ksmbd component.
When was CVE-2026-64140 published?
CVE-2026-64140 was published on July 19, 2026.