Listen to this Post
CVE-2026-64140 is a null pointer dereference vulnerability in the Linux kernel’s ksmbd module, which implements SMB2/SMB3 server functionality. The flaw resides in the `proc_show_files()` function, which handles reads of the `/proc/fs/ksmbd/files` interface used for system monitoring.
The vulnerability is triggered through a specific sequence of SMB2 operations. When a client establishes a session with durable handle support enabled (durable handles = yes), opens a file using a durable v2 handle, and then issues an SMB2 SESSION_LOGOFF, the `session_fd_check()` function clears the file pointer’s `tcon` (tree connection) reference by setting fp->tcon = NULL.
However, the file pointer itself remains registered in the global file table (global_ft.idr) until the durable scavenger thread cleans it up, which can take up to `fp->durable_timeout` seconds. During this window, the file pointer exists in a disconnected state—registered but with a NULL `tcon` reference.
If any process reads `/proc/fs/ksmbd/files` during this race window, `proc_show_files()` iterates through all registered file pointers and unconditionally dereferences `fp->tcon->id` without any NULL check. This results in a null pointer dereference, triggering an immediate kernel panic. The KASAN report confirms the fault at address `0xdffffc0000000000` with RIP proc_show_files+0x118/0x740.
The vulnerability is particularly concerning because the reproducer requires only a successful SMB2 SESSION_SETUP—no special privileges or complex conditions are needed beyond a share configured with durable handles. The fix involves adding a NULL guard before dereferencing `fp->tcon->id` and reporting the tree ID as 0 for disconnected file pointers.
DailyCVE Form:
Platform: Linux Kernel
Version: 7.0 (b38f99c1217a)
Vulnerability: Null Pointer Dereference
Severity: High (7.5 CVSS)
Date: 2026-07-19
Prediction: Patch expected 2026-07-20
What Undercode Say:
Analytics:
The vulnerability manifests as a classic use-after-free-adjacent race condition between resource cleanup (session logoff) and resource access (/proc read). The temporal window size is bounded by fp->durable_timeout, which is administrator-configurable but typically defaults to several seconds. Systems with aggressive monitoring (e.g., frequent cat /proc/fs/ksmbd/files) are at higher risk of encountering the panic window. The CVSS vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` reflects that the attack is network-accessible, low complexity, requires no privileges, and results in high availability impact (system crash) with no confidentiality or integrity impact.
Bash Commands:
Check if ksmbd is loaded and durable handles are enabled sudo modinfo ksmbd | grep -i durable sudo cat /proc/fs/ksmbd/config | grep -i durable Reproducer: Trigger the panic (requires SMB2 client) 1. Start ksmbd with durable handles enabled sudo modprobe ksmbd durable_handles=1 2. From a remote or local SMB2 client: - Establish SMB2 session - Open a file with durable v2 handle (SMB2_CREATE_DURABLE_HANDLE_REQUEST) - Issue SMB2 SESSION_LOGOFF - Immediately read /proc/fs/ksmbd/files cat /proc/fs/ksmbd/files <-- Triggers panic during window Check kernel logs for panic evidence sudo dmesg | grep -i "general protection fault" sudo dmesg | grep -i "proc_show_files"
Code (Vulnerable Snippet – Educational Purposes):
// fs/smb/server/vfs_cache.c - proc_show_files() (vulnerable)
static int proc_show_files(struct seq_file m, void v)
{
struct ksmbd_file fp;
int id = 0;
seq_printf(m, "id | pid | tid | uid | access | ...\n");
idr_for_each_entry(&global_ft.idr, fp, id) {
// VULNERABLE: No NULL check before dereferencing fp->tcon
seq_printf(m, "%d | %d | %d | ...\n",
fp->persistent_id,
fp->pid,
fp->tcon->id); // <-- NULL pointer dereference here
// ...
}
return 0;
}
Exploit (Educational Purposes!):
To reliably trigger the vulnerability:
- Setup: Ensure the target Linux system has `ksmbd` loaded with durable handles enabled (
durable handles = yesin the share configuration). - Session Establishment: Use an SMB2 client (e.g., `smbclient` or custom tool) to authenticate and establish a session with the ksmbd server.
- Durable Handle Creation: Open a file on the share with the `SMB2_CREATE_DURABLE_HANDLE_REQUEST` flag. This registers the file pointer in `global_ft.idr` with a durable v2 handle.
- Session Logoff: Issue `SMB2 SESSION_LOGOFF` without closing the durable handle. The `session_fd_check()` function clears `fp->tcon = NULL` but leaves the pointer registered.
- Trigger Panic: Immediately read `/proc/fs/ksmbd/files` (mode 0400) from any process on the system. The `proc_show_files()` function walks `global_ft.idr` and dereferences the NULL
fp->tcon, causing a kernel panic.
Protection:
- Immediate: Apply the patch that adds a NULL guard in `proc_show_files()` before dereferencing
fp->tcon->id. The fix has been committed in kernel versions 7.0.11 (commit8eab081627b6) and 7.1 (commit904901561e61). - Workaround: Disable durable handles on shares (
durable handles = no) if the fix cannot be applied immediately. This prevents the vulnerable code path from being reachable. - Long-term: Update to the latest stable kernel version. The Linux kernel CVE team recommends against cherry-picking individual commits; instead, upgrade to a full stable release.
Impact:
- Availability: High—successful exploitation causes an immediate kernel panic and system crash, resulting in denial of service for all services on the affected host.
- Confidentiality: None—the vulnerability does not leak information.
- Integrity: None—the vulnerability does not allow data modification.
- Attack Vector: Network-accessible—an unauthenticated remote attacker can trigger the condition by establishing an SMB2 session.
- Complexity: Low—the reproducer requires only basic SMB2 protocol knowledge and a share configured with durable handles.
- Affected Systems: All Linux systems running ksmbd with kernel version 7.0 (introduced in commit
b38f99c1217a) and durable handles enabled.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
