Executive brief
A null-pointer dereference vulnerability exists in the Linux kernel's SMB server implementation (ksmbd), which handles SMB/CIFS protocol connections used for file sharing. When memory allocation fails during share configuration setup, the code fails to validate the condition before attempting to use the uninitialized pointer, potentially causing a kernel crash that denies service to SMB clients.
Technical details
This is a null-pointer dereference (CWE-476) vulnerability in fs/smb/server/mgmt/share_config.c in the ksmbd_share_config_get() function. The vulnerable code path occurs when kstrdup() fails to allocate memory for share->name, but the error condition is not checked immediately afterward. Instead, execution continues and later ksmbd_ipc_tree_connect_request() calls strlen() on the null pointer, triggering a kernel panic. The vulnerability requires the attacker to cause memory allocation failure, which may be difficult to trigger reliably but can happen under resource-constrained conditions. The fix adds an explicit null check immediately after kstrdup() and cleanly exits the function if allocation fails. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel various (ksmbd component)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: fix committed upstream before disclosure