CVE-2026-53271

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn

into a local with neither READ_ONCE() nor a NULL check. Both run from

oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a

concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL

under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then

writes through NULL at offset 0xc4 -- a remotely triggerable oops.

Guard both reads the way compare_guid_key() already does: read

opinfo->conn with READ_ONCE() and return early if it is NULL, before

allocating the work struct so nothing leaks. A NULL conn means the

client is gone and the break is moot, so return 0; oplock_break() treats

that as success and runs the normal teardown.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References