PT-2026-52366 · Linux · Linux
Publicado
2026-06-25
·
Atualizado
2026-06-25
·
CVE-2026-53271
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
smb2 oplock break noti() and smb2 lease break noti() read opinfo->conn
into a local with neither READ ONCE() nor a NULL check. Both run from
oplock break() after opinfo get list() has dropped ci->m lock, so a
concurrent SMB2 LOGOFF (session fd check()) can set op->conn = NULL
under ci->m lock within that window. ksmbd conn r count inc(conn) then
writes through NULL at offset 0xc4 -- a remotely triggerable oops.
Guard both reads the way compare guid key() already does: read
opinfo->conn with READ ONCE() and return early if it is NULL, before
allocating the work struct so nothing leaks. A NULL conn means the
client is gone and the break is moot, so return 0; oplock break() treats
that as success and runs the normal teardown.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux