SB2026072092 - NULL pointer dereference in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-64140)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in proc_show_files() when reading /proc/fs/ksmbd/files after an SMB2 client opens a file with a durable v2 handle and issues SMB2 SESSION_LOGOFF. A remote user can establish an SMB2 session and trigger the vulnerable state to cause a denial of service.

Exploitation requires a share configured with durable handles enabled, and the crash occurs during the interval before the durable scavenger removes the disconnected file pointer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8eab081627b67216d1c8f638b68289b500dc9a6b
• https://git.kernel.org/stable/c/904901561e61a2b559070b20c74a8c95491f30aa