CVE-2026-64141

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix null pointer dereference in compare_guid_key()<br /> <br /> session_fd_check() walks the per-inode m_op_list during durable-handle<br /> session teardown and sets op-&gt;conn = NULL for every opinfo whose conn<br /> matched the closing session&amp;#39;s connection. The matching opinfo, however,<br /> stays linked in its per-ClientGuid lease_table_list entry&amp;#39;s lb-&gt;lease_list<br /> because destroy_lease_table() only runs on full TCP-connection teardown,<br /> not on SESSION_LOGOFF.<br /> <br /> If the same TCP connection then negotiates a fresh session with the<br /> same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and<br /> is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a<br /> lease context on a different inode, find_same_lease_key() walks<br /> lb-&gt;lease_list, reaches the stale opinfo, and calls compare_guid_key(),<br /> which unconditionally dereferences opinfo-&gt;conn-&gt;ClientGUID. The conn<br /> pointer is NULL and the kernel panics.<br /> <br /> Reproducer requires only a successful SMB2 SESSION_SETUP and a share<br /> configured with &amp;#39;durable handles = yes&amp;#39;. KASAN report on mainline<br /> 70390501d194:<br /> <br /> general protection fault, probably for non-canonical address<br /> 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI<br /> KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f]<br /> Workqueue: ksmbd-io handle_ksmbd_work<br /> RIP: 0010:bcmp+0x5b/0x230<br /> Call Trace:<br /> compare_guid_key+0x4b/0xd0<br /> find_same_lease_key+0x324/0x690<br /> smb2_open+0x6aea/0x8e60<br /> handle_ksmbd_work+0x796/0xee0<br /> ...<br /> <br /> Faulting address 0x348 is the offset of ClientGUID within struct<br /> ksmbd_conn, confirming opinfo-&gt;conn was NULL.<br /> <br /> Read opinfo-&gt;conn once and bail out if it has been cleared by a<br /> concurrent session_fd_check(). A half-detached opinfo cannot be the<br /> owner of an active lease, so returning 0 is the correct match result.