An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in     compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown     and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The     matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list     because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF. If the     same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to     NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease     context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and     calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is     NULL and the kernel panics. Reproducer requires only a successful SMB2 SESSION_SETUP and a share     configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault,     probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in     range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP:
    0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690     smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ... Faulting address 0x348 is the offset of     ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL. Read opinfo->conn once and bail out     if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of     an active lease, so returning 0 is the correct match result. (CVE-2026-64141)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
318773	Photon OS 5.0: Linux PHSA-2026-5.0-0864	Nessus	PhotonOS Local Security Checks	6/5/2026	8/1/2026	high
327995	Linux Distros Unpatched Vulnerability : CVE-2026-64141	Nessus	Misc.	7/20/2026	7/31/2026	high

Detections

Analytics

Plugins Search

high

high