Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) can allow a local user to crash the system. By accessing a specific system file while a network file share session is closing, an attacker can trigger a kernel panic. This results in a complete system outage and denial of service for all users and applications on the affected machine.
Technical details
A null pointer dereference exists in the ksmbd component of the Linux kernel within the proc_show_files() function. When an SMB2 client using durable v2 handles logs off, the session_fd_check() function clears the connection pointer (fp->tcon) but the file pointer remains in the global IDR table until a scavenger timer expires. If a local user reads /proc/fs/ksmbd/files during this window, the kernel attempts to dereference the null fp->tcon pointer, leading to a kernel panic (oops). The vulnerability requires ksmbd to be active with 'durable handles = yes' configured. Patches have been released for affected stable branches.
Affected products
- Linux Linux Kernel 7.0 to 7.0.11, 7.1
Timeline
- 2026-05-13: disclosed: Vulnerability reported by Jeremy Laratro
- 2026-07-19: advisory: CVE-2026-64140 published