CVE-2026-53271 is a vulnerability in Linux Kernel
Published on June 25, 2026
ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn
into a local with neither READ_ONCE() nor a NULL check. Both run from
oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a
concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL
under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then
writes through NULL at offset 0xc4 -- a remotely triggerable oops.
Guard both reads the way compare_guid_key() already does: read
opinfo->conn with READ_ONCE() and return early if it is NULL, before
allocating the work struct so nothing leaks. A NULL conn means the
client is gone and the break is moot, so return 0; oplock_break() treats
that as success and runs the normal teardown.
Products Associated with CVE-2026-53271
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8df4bcdb0a4232192b2445256c39b787d58ef14d and below 945a86b21b40fb17183f5b27461baa6f03e2467f is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below 1ff58dcfcab434ebb51649da33774fbb8e1f7b67 is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below e735dbd489e3ea02be78dba991056fe1138be51e is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below 75e33deda658c1ab3a9336cbdb1436536f9b3660 is affected.
- Version c8efcc786146a951091588e5fa7e3c754850cb3c and below b003086d76968298f22e7cf62239833b5a3a06b1 is affected.
- Version 6.6.32 and below 6.6.143 is affected.
- Version 6.9 is affected.
- Before 6.9 is unaffected.
- Version 6.6.143, <= 6.6.* is unaffected.
- Version 6.12.94, <= 6.12.* is unaffected.
- Version 6.18.36, <= 6.18.* is unaffected.
- Version 7.0.13, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.