CVE-2026-64140

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix null pointer dereference in proc_show_files()

When a SMB2 client opens a file with a durable v2 handle and then issues

SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the

reconnectable file pointer but leaves the fp registered in global_ft.idr

until the durable scavenger fires (up to fp->durable_timeout seconds

later).

During that window any read of /proc/fs/ksmbd/files (mode 0400) panics

the kernel because proc_show_files() walks global_ft.idr and

unconditionally dereferences fp->tcon->id with no NULL guard.

Reproducer requires only a successful SMB2 SESSION_SETUP and a share

configured with 'durable handles = yes'. KASAN report on mainline

70390501d194:

general protection fault, probably for non-canonical address

0xdffffc0000000000: 0000 [#1] SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:proc_show_files+0x118/0x740

Call Trace:

proc_show_files+0x118/0x740

seq_read_iter+0x4ef/0xe10

proc_reg_read_iter+0x1b7/0x280

...

Guard the dereference. A durable-disconnected fp legitimately has no

tcon; report its tree id as 0 rather than oopsing.