PT-2026-52366 · Linux · Linux
Published
2026-06-25
·
Updated
2026-06-25
·
CVE-2026-53271
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
smb2 oplock break noti() and smb2 lease break noti() read opinfo->conn
into a local with neither READ ONCE() nor a NULL check. Both run from
oplock break() after opinfo get list() has dropped ci->m lock, so a
concurrent SMB2 LOGOFF (session fd check()) can set op->conn = NULL
under ci->m lock within that window. ksmbd conn r count inc(conn) then
writes through NULL at offset 0xc4 -- a remotely triggerable oops.
Guard both reads the way compare guid key() already does: read
opinfo->conn with READ ONCE() and return early if it is NULL, before
allocating the work struct so nothing leaks. A NULL conn means the
client is gone and the break is moot, so return 0; oplock break() treats
that as success and runs the normal teardown.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux