CVE-2026-64141 is a vulnerability in Linux Kernel
Published on July 19, 2026
ksmbd: fix null pointer dereference in compare_guid_key()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in compare_guid_key()
session_fd_check() walks the per-inode m_op_list during durable-handle
session teardown and sets op->conn = NULL for every opinfo whose conn
matched the closing session's connection. The matching opinfo, however,
stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list
because destroy_lease_table() only runs on full TCP-connection teardown,
not on SESSION_LOGOFF.
If the same TCP connection then negotiates a fresh session with the
same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and
is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a
lease context on a different inode, find_same_lease_key() walks
lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(),
which unconditionally dereferences opinfo->conn->ClientGUID. The conn
pointer is NULL and the kernel panics.
Reproducer requires only a successful SMB2 SESSION_SETUP and a share
configured with 'durable handles = yes'. KASAN report on mainline
70390501d194:
general protection fault, probably for non-canonical address
0xdffffc0000000069: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f]
Workqueue: ksmbd-io handle_ksmbd_work
RIP: 0010:bcmp+0x5b/0x230
Call Trace:
compare_guid_key+0x4b/0xd0
find_same_lease_key+0x324/0x690
smb2_open+0x6aea/0x8e60
handle_ksmbd_work+0x796/0xee0
...
Faulting address 0x348 is the offset of ClientGUID within struct
ksmbd_conn, confirming opinfo->conn was NULL.
Read opinfo->conn once and bail out if it has been cleared by a
concurrent session_fd_check(). A half-detached opinfo cannot be the
owner of an active lease, so returning 0 is the correct match result.
Products Associated with CVE-2026-64141
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8df4bcdb0a4232192b2445256c39b787d58ef14d and below e43cb36d4d7827710cfcd48e95e29a507f0d87be is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below 0836081b394ca074d1b910f2b990ff7b4b4404c7 is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below cd5c1b75d2f454f625d7dc55bd3ae21d0855f6ad is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below af86896ca3239e25a6bd7d352213371265073d38 is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below 4b83cbc4c15f09b000cc06f033f64b0824b6dc87 is affected.
- Version 6.6.32 and below 6.6.142 is affected.
- Version 6.9 is affected.
- Before 6.9 is unaffected.
- Version 6.6.142, <= 6.6.* is unaffected.
- Version 6.12.92, <= 6.12.* is unaffected.
- Version 6.18.34, <= 6.18.* is unaffected.
- Version 7.0.11, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.