{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "b38f99c1217ae04753340f0fdcd8f35bf56841dc"
            },
            {
              "fixed": "8eab081627b67216d1c8f638b68289b500dc9a6b"
            },
            {
              "fixed": "904901561e61a2b559070b20c74a8c95491f30aa"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64140.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in proc_show_files()\n\nWhen a SMB2 client opens a file with a durable v2 handle and then issues\nSMB2 SESSION_LOGOFF, session_fd_check() clears fp-\u003etcon = NULL on the\nreconnectable file pointer but leaves the fp registered in global_ft.idr\nuntil the durable scavenger fires (up to fp-\u003edurable_timeout seconds\nlater).\n\nDuring that window any read of /proc/fs/ksmbd/files (mode 0400) panics\nthe kernel because proc_show_files() walks global_ft.idr and\nunconditionally dereferences fp-\u003etcon-\u003eid with no NULL guard.\n\nReproducer requires only a successful SMB2 SESSION_SETUP and a share\nconfigured with 'durable handles = yes'. KASAN report on mainline\n70390501d194:\n\n  general protection fault, probably for non-canonical address\n  0xdffffc0000000000: 0000 [#1] SMP KASAN PTI\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: 0010:proc_show_files+0x118/0x740\n  Call Trace:\n   proc_show_files+0x118/0x740\n   seq_read_iter+0x4ef/0xe10\n   proc_reg_read_iter+0x1b7/0x280\n   ...\n\nGuard the dereference. A durable-disconnected fp legitimately has no\ntcon; report its tree id as 0 rather than oopsing.",
  "id": "CVE-2026-64140",
  "modified": "2026-07-22T05:29:46.040180366Z",
  "published": "2026-07-19T15:40:33.194Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8eab081627b67216d1c8f638b68289b500dc9a6b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/904901561e61a2b559070b20c74a8c95491f30aa"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64140.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64140"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ksmbd: fix null pointer dereference in proc_show_files()"
}