CVE-2026-64141

A flaw was found in the ksmbd component of the Linux kernel. A remote attacker can trigger a null pointer dereference by negotiating a new session with a specific client identifier (ClientGuid) and issuing a Server Message Block (SMB2) CREATE request with a lease context on a different inode after a durable-handle session teardown. This can lead to a kernel panic, resulting in a denial of service (DoS).