CVE-2026-64140
- Source
- https://cve.org/CVERecord?id=CVE-2026-64140
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64140.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64140
- Downstream
- Published
- 2026-07-19T15:40:33.194Z
- Modified
- 2026-07-22T05:29:46.040180366Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- ksmbd: fix null pointer dereference in proc_show_files()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in procshowfiles()
When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSIONLOGOFF, sessionfdcheck() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in globalft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later).
During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because procshowfiles() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard.
Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:procshowfiles+0x118/0x740 Call Trace: procshowfiles+0x118/0x740 seqreaditer+0x4ef/0xe10 procregread_iter+0x1b7/0x280 ...
Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64140.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/8eab081627b67216d1c8f638b68289b500dc9a6b
- https://git.kernel.org/stable/c/904901561e61a2b559070b20c74a8c95491f30aa
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64140.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64140
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git