CVE-2026-64141

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux file-sharing code can crash the entire computer when a network client reconnects in a certain way, stopping file services until the system is restarted.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Memory Corruption
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Null pointer dereference in compare_guid_key() when find_same_lease_key() walks a stale opinfo entry whose conn pointer was cleared by session_fd_check() but remains linked in the lease_table_list after SESSION_LOGOFF; the dereference of opinfo->conn->ClientGUID triggers a kernel panic.

Why it matters to the business

Kernel panic crashes the system, interrupting SMB file sharing and any services relying on the affected Linux kernel; high availability impact with no data loss or code execution.

How an attack unfolds

An unauthenticated attacker establishes an SMB2 session on a share with durable handles enabled, performs SESSION_LOGOFF, then immediately negotiates a new session using the same ClientGuid and issues an SMB2 CREATE with a lease context on a different inode; this causes find_same_lease_key() to reach the half-detached opinfo and call compare_guid_key() on a NULL conn pointer.

How to fix it

Apply the upstream patch that adds a NULL check before dereferencing opinfo->conn in compare_guid_key(); rebuild and deploy an updated Linux kernel containing the fix for ksmbd durable-handle lease handling.

How to confirm the fix worked

Confirm the patched kernel no longer contains the unconditional dereference in compare_guid_key(); reproduce the original reproducer (SESSION_LOGOFF followed by CREATE with lease) and verify absence of general protection fault or KASAN null-ptr-deref in ksmbd-io workqueue.

Typical attack path

Connect to ksmbd and complete SMB2 NEGOTIATE + SESSION_SETUP
Open a durable handle on an inode
Issue SESSION_LOGOFF while keeping the TCP connection alive
Re-negotiate a fresh session with the identical ClientGuid
Send SMB2 CREATE containing a lease context targeting a different inode
Trigger find_same_lease_key() -> compare_guid_key() on the stale opinfo

How to detect it

Search kernel logs and dmesg for "general protection fault", "KASAN: null-ptr-deref", "compare_guid_key", "find_same_lease_key", or "handle_ksmbd_work" stack traces; correlate with SMB2 SESSION_LOGOFF followed immediately by CREATE requests on the same TCP connection.

compare_guid_key+0x4b/0xd0
find_same_lease_key+0x324/0x690
smb2_open+0x6aea/0x8e60
KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f]
Workqueue: ksmbd-io handle_ksmbd_work

What your security team should do

Prioritize kernel upgrade on all systems exposing ksmbd with durable handles enabled
Disable durable handles in smb.conf until patched kernels are deployed
Monitor kernel logs for ksmbd-related oops or panic entries
Restrict SMB exposure to trusted networks while unpatched

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF. If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ... Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL. Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result.

Affected packages

Ecosystem	Package	Introduced	Fixed