CVE-2026-53271ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops. Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Jun 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8df4bcdb0a4232192b2445256c39b787d58ef14d before 945a86b21b40fb17183f5b27461baa6f03e2467f; from c8efcc786146a951091588e5fa7e3c754850cb3c before 1ff58dcfcab434ebb51649da33774fbb8e1f7b67; from c8efcc786146a951091588e5fa7e3c754850cb3c before e735dbd489e3ea02be78dba991056fe1138be51e; from c8efcc786146a951091588e5fa7e3c754850cb3c before 75e33deda658c1ab3a9336cbdb1436536f9b3660; from c8efcc786146a951091588e5fa7e3c754850cb3c before b003086d76968298f22e7cf62239833b5a3a06b1; from 6.6.32 before 6.6.143 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.6.32 before 6.6.143; from 6.9 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; 7.1; and 2 more ranges | NVD |
References
- https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467fpatch
- https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67patch
- https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51epatch
- https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660patch
- https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.