Executive brief
A vulnerability exists in the Linux kernel's ksmbd server, which provides file-sharing services over a network. An authenticated user can trigger a system crash (kernel panic) by performing specific session logoff and reconnection actions when 'durable handles' are enabled. This results in a denial-of-service condition, potentially disrupting business operations and file access for all users on the affected server.
Technical details
A null pointer dereference exists in the ksmbd SMB server within the 'compare_guid_key()' function. The issue occurs because 'session_fd_check()' clears the 'opinfo->conn' pointer during session logoff, but the 'opinfo' structure remains linked in the lease list. If a client reconnects using the same ClientGuid and issues an SMB2 CREATE with a lease context, 'find_same_lease_key()' traverses the list and calls 'compare_guid_key()', which unconditionally dereferences the now-NULL connection pointer. This vulnerability requires ksmbd to be configured with 'durable handles = yes'. Patches have been released for various stable kernel branches to implement a proper NULL check using READ_ONCE.
Affected products
- Linux Linux Kernel ksmbd component with durable handles enabled
Timeline
- 2026-05-13: other: Patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0836081b394ca074d1b910f2b990ff7b4b4404c7
- https://git.kernel.org/stable/c/4b83cbc4c15f09b000cc06f033f64b0824b6dc87
- https://git.kernel.org/stable/c/af86896ca3239e25a6bd7d352213371265073d38
- https://git.kernel.org/stable/c/cd5c1b75d2f454f625d7dc55bd3ae21d0855f6ad
- https://git.kernel.org/stable/c/e43cb36d4d7827710cfcd48e95e29a507f0d87be