PT-2026-61457 · Linux · Linux
CVE-2026-64140
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in proc show files()
When a SMB2 client opens a file with a durable v2 handle and then issues
SMB2 SESSION LOGOFF, session fd check() clears fp->tcon = NULL on the
reconnectable file pointer but leaves the fp registered in global ft.idr
until the durable scavenger fires (up to fp->durable timeout seconds
later).
During that window any read of /proc/fs/ksmbd/files (mode 0400) panics
the kernel because proc show files() walks global ft.idr and
unconditionally dereferences fp->tcon->id with no NULL guard.
Reproducer requires only a successful SMB2 SESSION SETUP and a share
configured with 'durable handles = yes'. KASAN report on mainline
70390501d194:
general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:proc show files+0x118/0x740
Call Trace:
proc show files+0x118/0x740
seq read iter+0x4ef/0xe10
proc reg read iter+0x1b7/0x280
...
Guard the dereference. A durable-disconnected fp legitimately has no
tcon; report its tree id as 0 rather than oopsing.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux