CVE-2026-64140 Overview
CVE-2026-64140 is a null pointer dereference vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw resides in proc_show_files() and triggers when a Server Message Block version 2 (SMB2) client opens a file with a durable v2 handle and then issues an SMB2 SESSION_LOGOFF. During the durable scavenger window, reading /proc/fs/ksmbd/files dereferences a NULL fp->tcon pointer and panics the kernel. The vulnerability has been resolved upstream.
Critical Impact
A local unprivileged read of /proc/fs/ksmbd/files panics the kernel when a durable-disconnected SMB2 file pointer exists, producing a system-wide denial of service.
Affected Products
- Linux kernel with ksmbd compiled in and durable handles enabled
- SMB shares configured with durable handles = yes
- Kernel builds prior to commits 8eab081627b6 and 904901561e61
Discovery Timeline
- 2026-07-19 - CVE-2026-64140 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64140
Vulnerability Analysis
The defect is a classic Null Pointer Dereference [CWE-476] in the ksmbd procfs handler. When a client establishes a durable v2 handle and then sends SMB2 SESSION_LOGOFF, session_fd_check() sets fp->tcon = NULL on the reconnectable file pointer. The pointer remains registered in global_ft.idr until the durable scavenger reclaims it, which can take up to fp->durable_timeout seconds. During this interval, any read of /proc/fs/ksmbd/files (mode 0400) walks global_ft.idr and unconditionally dereferences fp->tcon->id, oopsing the kernel.
Root Cause
proc_show_files() assumes every file pointer registered in the global file table has a valid tcon (tree connection). The durable-handle lifecycle violates that assumption by intentionally clearing fp->tcon on logoff while keeping the fp reachable for later reconnection. The absence of a NULL guard on fp->tcon before accessing fp->tcon->id is the direct root cause.
Attack Vector
Exploitation requires a successful SMB2 SESSION_SETUP against a share configured with durable handles, followed by opening a durable v2 handle, then a SESSION_LOGOFF. A local reader with sufficient privileges to open /proc/fs/ksmbd/files (mode 0400, typically root) then triggers the panic. Although the file mode restricts local access, the vulnerable state is induced remotely over SMB2 without authentication to the local host, and the resulting crash yields a high-availability impact on the server.
The upstream fix adds a NULL check on fp->tcon inside proc_show_files() and reports the tree id as 0 for durable-disconnected file pointers instead of dereferencing the pointer. See the fix in the Kernel Git Commit Log and the stable backport.
Detection Methods for CVE-2026-64140
Indicators of Compromise
- Kernel general protection fault messages referencing proc_show_files+0x118/0x740 in dmesg or journalctl -k.
- KASAN reports flagged as null-ptr-deref in range [0x0000000000000000-0x0000000000000007] originating from ksmbd.
- Unexpected host reboots or panics correlated with SMB2 SESSION_LOGOFF traffic against shares with durable handles = yes.
Detection Strategies
- Alert on ksmbd-tagged kernel oops entries and any proc_show_files frame in kernel backtraces.
- Correlate SMB2 SESSION_SETUP followed by SESSION_LOGOFF sequences on durable-handle shares with subsequent host unavailability.
- Monitor process access to /proc/fs/ksmbd/files on ksmbd servers, especially from monitoring agents that periodically read procfs.
Monitoring Recommendations
- Forward ksmbd kernel logs and KASAN traces to a central log platform for panic-signature matching.
- Track ksmbd server uptime and unscheduled reboot counts to surface repeated crash conditions.
- Inventory Linux hosts with ksmbd loaded and durable handles enabled to scope exposure.
How to Mitigate CVE-2026-64140
Immediate Actions Required
- Apply the upstream kernel fix from commit 8eab081627b6 or the stable backport 904901561e61 and reboot affected hosts.
- If patching is not immediately possible, disable durable handles by setting durable handles = no in the affected ksmbd share configuration.
- Restrict read access to /proc/fs/ksmbd/files and audit any monitoring tooling that reads this path.
Patch Information
The vulnerability is fixed by guarding the fp->tcon dereference in proc_show_files(). A durable-disconnected fp legitimately has no tcon, so the fix reports the tree id as 0 instead of oopsing. Patches are available in the mainline commit and the stable branch commit. Deploy vendor-supplied kernel updates from your Linux distribution as soon as they incorporate these commits.
Workarounds
- Unload the ksmbd module (modprobe -r ksmbd) on hosts that do not require in-kernel SMB serving.
- Set durable handles = no in ksmbd.conf to prevent the vulnerable code path from being reachable.
- Block untrusted SMB2 clients at the network boundary to reduce the ability to induce the durable-disconnected state.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
