Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-53271

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops. Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 8df4bcdb0a4232192b2445256c39b787d58ef14d to < 945a86b21b40fb17183f5b27461baa6f03e2467faffected
  • c8efcc786146a951091588e5fa7e3c754850cb3c to < 1ff58dcfcab434ebb51649da33774fbb8e1f7b67affected
  • c8efcc786146a951091588e5fa7e3c754850cb3c to < e735dbd489e3ea02be78dba991056fe1138be51eaffected
  • c8efcc786146a951091588e5fa7e3c754850cb3c to < 75e33deda658c1ab3a9336cbdb1436536f9b3660affected
  • c8efcc786146a951091588e5fa7e3c754850cb3c to < b003086d76968298f22e7cf62239833b5a3a06b1affected
  • 6.6.32 to < 6.6.143affected

Linux Linux

Default version status: affected

  • 6.9affected
  • 0 to < 6.9unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References