CVE-2026-64141 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in compare_guid_key()
session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF.
If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics.
Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194:
general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f]
Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ...
Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL.
Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical null pointer dereference in the ksmbd kernel module that affects SMB2 server implementations within Linux systems. This issue manifests during the handling of durable handles and session teardown operations where improper cleanup of operational context leads to memory corruption. The flaw occurs specifically when a TCP connection undergoes session logoff followed by a new session establishment using the same ClientGuid, creating a scenario where stale operational information persists in lease table structures.
The technical root cause involves the inconsistent state management between session teardown and lease table cleanup operations. During session_fd_check(), the code properly sets op->conn = NULL for matching operations but fails to remove these stale entries from the lease_table_list structure. This creates a dangling reference that can be accessed later when new operations attempt to validate lease keys through find_same_lease_key(). The compare_guid_key() function then unconditionally dereferences opinfo->conn->ClientGUID without first validating that conn is non-null, resulting in immediate kernel panic and system crash.
This vulnerability directly maps to CWE-476 which describes null pointer dereference conditions in software implementations. The operational impact extends beyond simple system crashes as it represents a potential denial of service vector that could be exploited by authenticated users to disrupt SMB services. The KASAN report confirms the precise memory access violation at offset 0x348, which corresponds to the ClientGUID field within the ksmbd_conn structure, validating that the conn pointer had been set to NULL during previous session cleanup operations.
The exploitation requires minimal prerequisites including a successful SMB2 SESSION_SETUP and configuration with durable handles enabled, making this vulnerability particularly concerning for production environments. The fix implemented addresses the race condition by performing null validation before dereferencing the conn pointer in compare_guid_key(), ensuring that stale operational contexts return appropriate match results rather than causing kernel panics. This approach aligns with ATT&CK technique T1499.004 which covers network disruption through service availability attacks, and represents a proper defensive programming practice against concurrent access race conditions in kernel-space memory management operations.
The vulnerability demonstrates the complexity of managing persistent connection state in network servers where client identifiers can persist across multiple session lifecycles. The improper cleanup during partial session teardown creates a dangerous condition where freed memory references remain accessible through different code paths, highlighting the importance of comprehensive resource management and proper state synchronization in kernel modules handling network protocols with complex session semantics.