Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64141— ksmbd: fix null pointer dereference in compare_guid_key()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ksmbd的compare_guid_key()函数中的空指针取消引用问题，在会话拆除过程中未正确清理opinfo连接指针，可能导致内核崩溃。

CVSS 7.5 · High EPSS 0.63% · P49

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 13

VendorProduct Version RangeStatus
Linux Linux 8df4bcdb0a4232192b2445256c39b787d58ef14d< e43cb36d4d7827710cfcd48e95e29a507f0d87be affected
c8efcc786146a951091588e5fa7e3c754850cb3c< 0836081b394ca074d1b910f2b990ff7b4b4404c7 affected
c8efcc786146a951091588e5fa7e3c754850cb3c< cd5c1b75d2f454f625d7dc55bd3ae21d0855f6ad affected
c8efcc786146a951091588e5fa7e3c754850cb3c< af86896ca3239e25a6bd7d352213371265073d38 affected
c8efcc786146a951091588e5fa7e3c754850cb3c< 4b83cbc4c15f09b000cc06f033f64b0824b6dc87 affected
6.6.32< 6.6.142 affected
6.9 affected
< 6.9 unaffected
… +5 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64141

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: fix null pointer dereference in compare_guid_key()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF. If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ... Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL. Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ksmbd的compare_guid_key()函数中的空指针取消引用问题，在会话拆除过程中未正确清理opinfo连接指针，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8df4bcdb0a4232192b2445256c39b787d58ef14d ~ e43cb36d4d7827710cfcd48e95e29a507f0d87be -
Linux Linux 6.9 -

II. Public POCs for CVE-2026-64141

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64141

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64141 (5)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-64136 9.8 CRITICAL smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
CVE-2026-63994 9.8 CRITICAL tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-64113 9.8 CRITICAL ixgbevf: fix use-after-free in VEPA multicast source pruning
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-64122 9.8 CRITICAL net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
CVE-2026-63825 9.8 CRITICAL gcov: use atomic counter updates to fix concurrent access crashes
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-64132 9.8 CRITICAL ipv6: ioam: refresh hdr pointer before ioam6_event()
CVE-2026-64091 9.8 CRITICAL batman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-63888 9.8 CRITICAL scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64141

No comments yet

Leave a comment