Listen to this Post
CVE-2026-64141 is a high-severity null pointer dereference vulnerability in the Linux kernel’s ksmbd module, which implements the SMB2 server protocol. The flaw resides in the `compare_guid_key()` function within fs/smb/server/oplock.c.
The vulnerability arises from inconsistent state management during SMB2 durable-handle session teardown. During a session teardown, `session_fd_check()` walks the per-inode `m_op_list` and sets `op->conn = NULL` for every `opinfo` whose connection matches the closing session. However, the matching `opinfo` remains linked in its per-ClientGuid `lease_table_list` entry’s `lb->lease_list` because `destroy_lease_table()` only executes on full TCP-connection teardown, not on SESSION_LOGOFF.
If the same TCP connection negotiates a fresh session using the same ClientGuid (which is bound to the NEGOTIATE phase and remains unchanged across LOGOFF + SETUP) and issues an SMB2 CREATE request with a lease context on a different inode, `find_same_lease_key()` traverses lb->lease_list. It reaches the stale `opinfo` and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. Since `opinfo->conn` was set to NULL during teardown, this triggers a null pointer dereference and kernel panic.
The KASAN report confirmed the crash: a general protection fault at address 0xdffffc0000000069, with the faulting address `0x348` being the offset of `ClientGUID` within struct ksmbd_conn. The fix involves reading `opinfo->conn` once and bailing out if it has been cleared, returning 0 as the correct match result for a half-detached opinfo.
DailyCVE Form:
Platform: Linux Kernel
Version: up to 6.6.141 / 6.12.91 / 6.18.33 / 7.0.10
Vulnerability: Null Pointer Dereference (CWE-476)
Severity: HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
date: 2026-07-19
Prediction: 2026-07-20 (Patch already available)
What Undercode Say
The following analytics and commands provide technical insight into CVE-2026-64141.
KASAN Report Analysis:
general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [bash] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0
Check ksmbd Status:
sudo systemctl status ksmbd
Verify Durable Handles Configuration:
grep -r "durable handles" /etc/ksmbd/
Check Kernel Version:
uname -r
Review ksmbd Logs:
sudo journalctl -u ksmbd -f
Exploit (Educational Purposes!)
The vulnerability can be triggered by an authenticated remote user with the following conditions:
1. Establish a TCP connection to the ksmbd SMB2 server.
2. Perform a successful SMB2 `SESSION_SETUP` with a ClientGuid.
3. Issue SMB2 CREATE requests with lease contexts to populate the lease table.
4. Perform `SESSION_LOGOFF` (teardown session without closing TCP connection).
5. Negotiate a fresh session on the same TCP connection with the same ClientGuid.
6. Issue an SMB2 CREATE request with a lease context on a different inode.
SMB2 Client <-> Linux ksmbd Server (durable handles = yes) 1. SESSION_SETUP (ClientGuid = G) 2. CREATE (inode A, lease) --> opinfo added to lease_list 3. SESSION_LOGOFF --> op->conn = NULL (stale opinfo remains in lease_list) 4. SESSION_SETUP (ClientGuid = G) --> same TCP conn, same ClientGuid 5. CREATE (inode B, lease) --> find_same_lease_key() traverses lease_list --> reaches stale opinfo --> compare_guid_key() dereferences NULL conn --> KERNEL PANIC
No public exploit is available for this vulnerability.
Protection
Mitigation Steps:
- Apply the Patch: Update to a patched kernel version containing the fix. The patch was committed to mainline at
70390501d194. - Disable Durable Handles (Workaround): Set `durable handles = no` in the ksmbd share configuration to prevent exploitation.
- Update from Vendor Repositories: Install the latest security update from your Linux distribution’s repository.
Check for Patch Availability:
Debian/Ubuntu apt-cache policy linux-image-$(uname -r) RHEL/CentOS/Fedora rpm -q kernel Check if CVE is addressed grep CVE-2026-64141 /usr/share/doc/kernel-/ChangeLog
Impact
- Denial of Service (DoS): Successful exploitation causes an immediate kernel panic, crashing the entire system.
- Service Disruption: The ksmbd SMB service becomes unavailable, affecting all connected clients.
- Authenticated Remote Attack: An attacker must have valid SMB2 authentication credentials.
- No Data Breach: The vulnerability only leads to system crashes; it does not allow data leakage or privilege escalation.
- Wide Affected Range: Impacts Linux kernel versions up to 6.6.141, 6.12.91, 6.18.33, and 7.0.10.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
