{"id":"CVE-2026-64140","summary":"ksmbd: fix null pointer dereference in proc_show_files()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in proc_show_files()\n\nWhen a SMB2 client opens a file with a durable v2 handle and then issues\nSMB2 SESSION_LOGOFF, session_fd_check() clears fp-\u003etcon = NULL on the\nreconnectable file pointer but leaves the fp registered in global_ft.idr\nuntil the durable scavenger fires (up to fp-\u003edurable_timeout seconds\nlater).\n\nDuring that window any read of /proc/fs/ksmbd/files (mode 0400) panics\nthe kernel because proc_show_files() walks global_ft.idr and\nunconditionally dereferences fp-\u003etcon-\u003eid with no NULL guard.\n\nReproducer requires only a successful SMB2 SESSION_SETUP and a share\nconfigured with 'durable handles = yes'. KASAN report on mainline\n70390501d194:\n\n  general protection fault, probably for non-canonical address\n  0xdffffc0000000000: 0000 [#1] SMP KASAN PTI\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: 0010:proc_show_files+0x118/0x740\n  Call Trace:\n   proc_show_files+0x118/0x740\n   seq_read_iter+0x4ef/0xe10\n   proc_reg_read_iter+0x1b7/0x280\n   ...\n\nGuard the dereference. A durable-disconnected fp legitimately has no\ntcon; report its tree id as 0 rather than oopsing.","modified":"2026-07-22T05:29:46.040180366Z","published":"2026-07-19T15:40:33.194Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64140.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/8eab081627b67216d1c8f638b68289b500dc9a6b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/904901561e61a2b559070b20c74a8c95491f30aa"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64140.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64140"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b38f99c1217ae04753340f0fdcd8f35bf56841dc"},{"fixed":"8eab081627b67216d1c8f638b68289b500dc9a6b"},{"fixed":"904901561e61a2b559070b20c74a8c95491f30aa"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64140.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64140.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}