CVE-2026-64140 Linux CVE debrief

Who should care

Linux kernel users and administrators of systems with SMB2 client configurations should be aware of this vulnerability and ensure that their systems are updated with the latest kernel patches. This includes reviewing and updating SMB2 client configurations to prevent exploitation and monitoring system logs for potential exploitation attempts. Additionally, defenders should review system logs for potential exploitation attempts and ensure that their systems are updated with the latest kernel patches.

Technical summary

The vulnerability is caused by a null pointer dereference in proc_show_files() when a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF. The file pointer remains registered in global_ft.idr until the durable scavenger fires, causing a kernel panic when reading /proc/fs/ksmbd/files. The issue is resolved by adding a NULL guard for fp->tcon->id. This vulnerability can be reproduced with a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'.

Defensive priority

Medium-High

Recommended defensive actions

• Apply the latest Linux kernel patches to ensure that the vulnerability is addressed.
• Review and update SMB2 client configurations to prevent exploitation.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was resolved by adding a NULL guard for fp->tcon->id in proc_show_files(). The issue can be reproduced with a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. To verify, defenders should review system logs for potential exploitation attempts and ensure that their systems are updated with the latest kernel patches. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.