CVE-2026-64141: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64141 Overview

CVE-2026-64141 is a null pointer dereference vulnerability in the Linux kernel ksmbd in-kernel SMB server. The flaw resides in the compare_guid_key() function, which unconditionally dereferences opinfo->conn->ClientGUID during SMB2 lease lookups. When a session logoff clears op->conn but leaves the opinfo linked in the per-ClientGuid lease_table_list, a subsequent SMB2 CREATE with a lease context on the same TCP connection triggers a kernel panic.

Critical Impact
Remote, unauthenticated attackers can crash the Linux kernel on any host exposing an SMB share configured with durable handles = yes, resulting in denial of service.

Affected Products

Linux kernel ksmbd SMB3 server module
Systems exposing SMB shares with durable handles = yes configured
Multiple stable kernel branches referenced in upstream commits 0836081b394c, 4b83cbc4c15f, af86896ca323, cd5c1b75d2f4, and e43cb36d4d78

Discovery Timeline

2026-07-19 - CVE-2026-64141 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64141

Vulnerability Analysis

The defect lives in the ksmbd durable-handle and lease-tracking logic. During SMB2 SESSION_LOGOFF, session_fd_check() walks the per-inode m_op_list and sets op->conn = NULL on every opinfo that referenced the closing session's connection. The same opinfo, however, remains linked in its per-ClientGuid lease_table_list entry via lb->lease_list. That list is only torn down by destroy_lease_table() on full TCP-connection teardown, not on session logoff.

When the same TCP connection then completes a fresh SESSION_SETUP reusing the identical ClientGuid, which is bound to NEGOTIATE rather than to a session, and issues an SMB2 CREATE with a lease context on a different inode, find_same_lease_key() traverses lb->lease_list and reaches the stale opinfo. compare_guid_key() then dereferences the cleared conn pointer, producing a general protection fault reported by KASAN as a null-ptr-deref in range [0x0000000000000348-0x000000000000034f]. Offset 0x348 corresponds to ClientGUID within struct ksmbd_conn.

Root Cause

The root cause is inconsistent lifetime management between the m_op_list connection reference and the lease_table_list membership [CWE-476]. session_fd_check() clears opinfo->conn without removing the opinfo from lease tracking structures, leaving a half-detached opinfo that later consumers assume is fully populated.

Attack Vector

Exploitation only requires a successful SMB2 SESSION_SETUP against a share configured with durable handles = yes. An attacker performs a session setup, issues a SESSION_LOGOFF, negotiates a new session reusing the same ClientGuid, and sends an SMB2 CREATE with a lease context targeting a different inode. The stale opinfo path is taken and the kernel panics.

No authentication material beyond what is needed to establish an SMB session is required, and the entire sequence is remote and network-reachable.

Detection Methods for CVE-2026-64141

Indicators of Compromise

Kernel oops or general protection fault entries referencing compare_guid_key+0x4b/0xd0, find_same_lease_key, or smb2_open in dmesg or /var/log/messages.
KASAN reports of null-ptr-deref in the bcmp path invoked from ksmbd-io workqueue handlers.
Unexpected reboots or SMB service unavailability on hosts running ksmbd with durable handles enabled.

Detection Strategies

Monitor kernel crash logs and kdump output for stack traces containing handle_ksmbd_work followed by smb2_open and find_same_lease_key.
Instrument SMB traffic to flag clients that issue rapid SESSION_SETUP → SESSION_LOGOFF → SESSION_SETUP sequences reusing the same ClientGuid on a single TCP connection.
Correlate SMB2 CREATE requests carrying lease contexts against preceding logoff events from the same source IP.

Monitoring Recommendations

Enable persistent kernel log collection and forward dmesg to a central log store for post-crash analysis.
Track availability of SMB services and alert on process restarts of ksmbd worker threads.
Audit share configurations for durable handles = yes and inventory hosts exposing SMB to untrusted networks.

How to Mitigate CVE-2026-64141

Immediate Actions Required

Apply the upstream ksmbd fix from the referenced kernel commit af86896ca323 or the corresponding stable backport for your kernel branch.
Restrict SMB access at the network layer to trusted subnets until patched kernels are deployed.
Disable the ksmbd module on hosts that do not require in-kernel SMB serving.

Patch Information

The fix reads opinfo->conn once into a local variable and returns early if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot own an active lease, so returning 0 is the correct match result. Patched commits are available at kernel.org commit 0836081b, commit 4b83cbc4, commit af86896c, commit cd5c1b75, and commit e43cb36d.

Workarounds

Set durable handles = no in the ksmbd share configuration to prevent the vulnerable code path from being reachable.
Unload the ksmbd kernel module and route SMB workloads to a user-space server such as Samba until a patched kernel is in place.
Enforce firewall rules blocking TCP/445 from untrusted networks to reduce the exposed attack surface.

bash

# Disable durable handles on affected ksmbd shares
# /etc/ksmbd/ksmbd.conf
[global]
    durable handles = no

# Reload the ksmbd configuration
sudo ksmbd.control --reload

# Or unload the module entirely if ksmbd is not required
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd