Null Pointer Dereference in Linux Kernel SMB2 Handling

CVE-2026-64140

What is CVE-2026-64140?

A vulnerability in the Linux kernel's SMB2 handling can lead to a kernel panic due to a null pointer dereference during file operations. When an SMB2 client interacts with files using a durable v2 handle and subsequently logs off the session, the system fails to properly manage the file pointer. This results in the file pointer being improperly registered in a global structure, leading to a dereference of an invalid memory address in the proc_show_files function. If a read operation is attempted on the /proc/fs/ksmbd/files, it triggers a kernel panic rather than handling the case gracefully. The issue arises specifically when durable handles are configured and poses a significant risk to system stability. Corrective actions involve implementing a guard for this dereference to prevent kernel crashes.

References