CVE-2026-64141 Linux CVE debrief

Who should care

Linux kernel users, ksmbd administrators, and security teams should be aware of this vulnerability and take necessary actions to mitigate it. They should review the Linux kernel repository for the patch, ensure that ksmbd is properly configured and secured, and monitor kernel logs for potential attacks.

Technical summary

The vulnerability is caused by a null pointer dereference in the compare_guid_key() function. This function is called when a lease context is created for a different inode, and it tries to access the ClientGUID of the connection, which is null. To fix this vulnerability, it is recommended to read the opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). The fix involves modifying the compare_guid_key() function to handle the null pointer case.

Defensive priority

High

Recommended defensive actions

• Apply the patch from the Linux kernel repository
• Disable durable handles in ksmbd configuration
• Monitor kernel logs for potential attacks
• Implement compensating controls to detect and prevent exploitation
• Verify ksmbd configuration and ensure it is properly secured
• Review Linux kernel repository for the patch
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was resolved in the Linux kernel repository. The reproducer requires a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. To verify, defenders should review the Linux kernel repository for the patch and ensure that ksmbd is properly configured and secured. Additionally, defenders should monitor kernel logs for potential attacks and implement compensating controls to detect and prevent exploitation.

Official resources