In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in proc_show_files()
When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later).
During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard.
Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ...
Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-azure-fde-7.0Upgrade linux-image-gcpUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-gcp-7.0Upgrade linux-image-oracleUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-raspi-realtimeUpgrade linux-image-7.0.0-1009-awsUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-7.0.0-2016-nvidia-bos-64kUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-azure-7.0Upgrade linux-image-raspi-7.0Upgrade linux-image-7.0.0-1010-azureUpgrade linux-image-aws-64kUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-awsUpgrade linux-image-azure-fdeUpgrade linux-image-aws-7.0Upgrade linux-image-nvidia-7.0Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-oracle-7.0Upgrade linux-image-ibmUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-azureUpgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-7.0.0-2016-nvidia-bosUpgrade linux-image-raspiUpgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-aws-64k-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-nvidia-bosUpgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-nvidia-bos-64k-7.0 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub