In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in proc_show_files()
When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later).
During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard.
Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ...
Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-nvidiaUpgrade linux-image-raspiUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-ibmUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-azure-fdeUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-azureUpgrade linux-image-nvidia-bos-64kUpgrade linux-image-nvidia-7.0Upgrade linux-image-oracle-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-2016-nvidia-bosUpgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-aws-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-nvidia-bosUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-raspi-realtimeUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-nvidia-64kUpgrade linux-image-gcp-7.0Upgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-7.0.0-1009-awsUpgrade linux-image-oracle-64kUpgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-awsUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-2016-nvidia-bos-64kUpgrade linux-image-gcpUpgrade linux-image-azure-fde-7.0Upgrade linux-image-oracleUpgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-raspi-7.0Upgrade linux-image-azure-7.0Upgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-nvidia-64k-hwe-26.04 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub