Linux Kernel ksmbd CVE-2026-64141

The affected server must run ksmbd with at least one share configured with 'durable handles = yes' (non-default) - this is the exact setting the reproducer names. The attacker must successfully complete an SMB2 SESSION_SETUP, then reuse the same TCP connection (which preserves the NEGOTIATE-bound ClientGuid) across a LOGOFF + fresh SETUP, and issue an SMB2 CREATE carrying a lease context on a different inode than the one whose opinfo was left stale. Limiting factors: exploitation depends on the durable-handles configuration and on winning/triggering the lifecycle race where session_fd_check() has cleared op->conn while the opinfo remains linked in lb->lease_list; hosts where ksmbd is disabled or durable handles are off are not exploitable. Although CVSS rates PR:N, a genuinely reachable SESSION_SETUP may require valid share credentials depending on server authentication policy.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure availability impact - a kernel crash - reachable over the network with low complexity and no authentication or user interaction, consistent with the 'Denial Of Service' tag. However, the exploitation narrative introduces a nuance the raw vector omits: the attacker must complete an SMB2 SESSION_SETUP and target a share explicitly configured with 'durable handles = yes', which is not the ksmbd default, so realistic exploitation is somewhat gated by server configuration. Corroborating low-urgency signals: EPSS is 0.17% (6th percentile), the CVE is NOT in CISA KEV, and no POC is referenced - so this is not actively exploited and not weaponized. There is no confidentiality or integrity impact; the worst case is a remote crash/reboot of the file server. Net: a genuine remote DoS worth patching on internet-exposed or multi-tenant ksmbd deployments, but not an emergency-tier issue for hosts where ksmbd is disabled or durable handles are off. Note the PR:N rating: the vector treats the SESSION_SETUP as unauthenticated-reachable, but a full setup may itself require valid credentials on hardened shares - verify against your share's authentication configuration.

An attacker who can reach the ksmbd service on TCP 445 completes an SMB2 negotiate and session setup, then issues a LOGOFF and re-runs SESSION_SETUP over the same TCP connection, preserving the ClientGuid. They then send an SMB2 CREATE with a lease context on a different inode, causing find_same_lease_key() to reach the stale opinfo and dereference a NULL conn, panicking the kernel and taking the file server offline. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) makes a bespoke crasher straightforward for anyone able to authenticate a session.