CVE-2026-53271

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

Published Jun 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn
into a local with neither READ_ONCE() nor a NULL check. Both run from
oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a
concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL
under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then
writes through NULL at offset 0xc4 -- a remotely triggerable oops.

Guard both reads the way compare_guid_key() already does: read
opinfo->conn with READ_ONCE() and return early if it is NULL, before
allocating the work struct so nothing leaks. A NULL conn means the
client is gone and the break is moot, so return 0; oplock_break() treats
that as success and runs the normal teardown.

Analysis

Technical impact

In the Linux kernel, the SMB server component ksmbd contains a race condition that allows a concurrent SMB2 LOGOFF to clear the opinfo->conn pointer while oplock/lease break notifiers are running. The notifiers read this pointer without a NULL check, causing a null pointer dereference that triggers a kernel oops and system crash. The flaw results in a denial of service; no evidence in the description indicates arbitrary code execution.

Affected Systems

All Linux kernels that incorporate the upstream ksmbd implementation without the patch are affected. No version range is specified, so any build of the kernel that has not applied the referenced commit is vulnerable.

Risk and Exploitability

Exploitation is possible remotely by a malicious SMB client that sequences lease or oplock requests with a LOGOFF to produce the race. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates a moderate risk level. Because the flaw causes a kernel oops, an attacker can terminate the system, disrupting availability. There is no confirmed privilege escalation path beyond the crash, but the high impact and lack of mitigations make the risk significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8df4bcdb0a4232192b2445256c39b787d58ef14d`	affected	< 945a86b21b40fb17183f5b27461baa6f03e2467f
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< 1ff58dcfcab434ebb51649da33774fbb8e1f7b67
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< e735dbd489e3ea02be78dba991056fe1138be51e
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< 75e33deda658c1ab3a9336cbdb1436536f9b3660
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< b003086d76968298f22e7cf62239833b5a3a06b1
`6.6.32`	affected	< 6.6.143

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[8df4bcdb0a4232192b2445256c39b787d58ef14d,945a86b21b40fb17183f5b27461baa6f03e2467f)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,1ff58dcfcab434ebb51649da33774fbb8e1f7b67)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,e735dbd489e3ea02be78dba991056fe1138be51e)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,75e33deda658c1ab3a9336cbdb1436536f9b3660)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,b003086d76968298f22e7cf62239833b5a3a06b1)`	affected	code_commit	—
`[6.6.32,6.6.143)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.9`	affected	semver	—
`[0,6.9)`	unaffected	semver	—
`[6.6.143,7.0.0]`	unaffected	semver	—
`[6.12.94,7.0.0]`	unaffected	semver	—
`[6.18.36,7.0.0]`	unaffected	semver	—
`[7.0.13,8.0.0]`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the ksmbd patch and apply the update through your distribution’s package manager.
If a kernel update cannot be applied immediately, manually apply the commit that adds NULL checks to ksmbd’s oplock/lease break notifiers—pull the referenced patch and rebuild the kernel.
Restrict SMB traffic to trusted sources or disable oplock/lease handling in the SMB server configuration if the feature is not essential.

Generated by OpenCVE AI on August 13, 2026 at 15:09 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.162% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67
https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660
https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467f
https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1
https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51e
https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53271-711f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53271
https://www.cve.org/CVERecord?id=CVE-2026-53271

History

Aug 13, 2026 1:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-872

Jun 26, 2026 12:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53271-711f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53271 https://www.cve.org/CVERecord?id=CVE-2026-53271

Jun 25, 2026 12:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-872

Jun 25, 2026 9:15 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops. Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown.
Title		ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67 https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660 https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467f https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1 https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51e