CVE-2026-64140

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix null pointer dereference in proc_show_files()<br /> <br /> When a SMB2 client opens a file with a durable v2 handle and then issues<br /> SMB2 SESSION_LOGOFF, session_fd_check() clears fp-&gt;tcon = NULL on the<br /> reconnectable file pointer but leaves the fp registered in global_ft.idr<br /> until the durable scavenger fires (up to fp-&gt;durable_timeout seconds<br /> later).<br /> <br /> During that window any read of /proc/fs/ksmbd/files (mode 0400) panics<br /> the kernel because proc_show_files() walks global_ft.idr and<br /> unconditionally dereferences fp-&gt;tcon-&gt;id with no NULL guard.<br /> <br /> Reproducer requires only a successful SMB2 SESSION_SETUP and a share<br /> configured with &amp;#39;durable handles = yes&amp;#39;. KASAN report on mainline<br /> 70390501d194:<br /> <br /> general protection fault, probably for non-canonical address<br /> 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI<br /> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]<br /> RIP: 0010:proc_show_files+0x118/0x740<br /> Call Trace:<br /> proc_show_files+0x118/0x740<br /> seq_read_iter+0x4ef/0xe10<br /> proc_reg_read_iter+0x1b7/0x280<br /> ...<br /> <br /> Guard the dereference. A durable-disconnected fp legitimately has no<br /> tcon; report its tree id as 0 rather than oopsing.