CVE-2026-64141

CVE CVE-2026-64141EUVD EUVD-2026-45826Published 2026-07-19T15:40:33.000ZLast changed 2026-08-05T12:39:41.000ZCVSS 7.5

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF. If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ... Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL. Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.6.142; c8efcc786146a951091588e5fa7e3c754850cb3c <af86896ca3239e25a6bd7d352213371265073d38; c8efcc786146a951091588e5fa7e3c754850cb3c <4b83cbc4c15f09b000cc06f033f64b0824b6dc87; patch: 6.12.92; patch: 6.18.34; patch: 0; patch: 7.1; 6.6.32 <6.6.142; 6.9; c8efcc786146a951091588e5fa7e3c754850cb3c <0836081b394ca074d1b910f2b990ff7b4b4404c7; c8efcc786146a951091588e5fa7e3c754850cb3c <cd5c1b75d2f454f625d7dc55bd3ae21d0855f6ad; 8df4bcdb0a4232192b2445256c39b787d58ef14d <e43cb36d4d7827710cfcd48e95e29a507f0d87be; patch: 7.0.11

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.