Linux Kernel ksmbd EUVD-2026-45825

Requires ksmbd to be running with a share configured with 'durable handles = yes'; an SMB2 client must complete SESSION_SETUP, open a file with a durable v2 handle, and issue SMB2 SESSION_LOGOFF to leave a reconnectable fp with NULL tcon. The crash then fires only when a process reads /proc/fs/ksmbd/files, which is mode 0400 and thus readable only by root - this local, privileged read is the true limiting factor and contradicts the AV:N/PR:N CVSS vector. Exploitation is further bounded by the timing window (fp is reclaimed by the durable scavenger after fp->durable_timeout seconds) and does not affect default configurations where durable handles are disabled or ksmbd is not loaded.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) captures only the availability impact but overstates reachability: the panic is triggered by reading /proc/fs/ksmbd/files, which is mode 0400 and therefore readable only by root. The network component (an SMB2 client establishing the durable handle and logging off) merely sets up the NULL-tcon condition; the actual crash requires a local privileged read of the proc file. This network-vector-vs-local-trigger conflict should be verified with the vendor - realistically this is a local, privilege-dependent DoS, not remote-unauthenticated. Supporting signals reinforce low real-world urgency: EPSS is 0.16% (6th percentile), the vulnerability is not in CISA KEV, no POC is published, impact is DoS-only (C:N/I:N), and it only manifests when ksmbd is running with durable handles enabled and an operator/monitoring process reads the debug file. This is a genuine crash bug worth patching in ksmbd deployments but is a low priority relative to its 7.5 headline score.

An attacker (or a misbehaving client) performs an SMB2 SESSION_SETUP against a ksmbd share with 'durable handles = yes', opens a file with a durable v2 handle, then sends SMB2 SESSION_LOGOFF, leaving a file pointer with fp->tcon = NULL registered for up to durable_timeout seconds. During that window a root-privileged local process - an admin or a monitoring agent - reads /proc/fs/ksmbd/files, dereferencing the NULL tcon and panicking the kernel. No public POC is identified at time of analysis, but the reproducer is described directly in the advisory.