CVE-2026-53271 - Vulnerability Details

- ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn
into a local with neither READ_ONCE() nor a NULL check. Both run from
oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a
concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL
under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then
writes through NULL at offset 0xc4 -- a remotely triggerable oops.

Guard both reads the way compare_guid_key() already does: read
opinfo->conn with READ_ONCE() and return early if it is NULL, before
allocating the work struct so nothing leaks. A NULL conn means the
client is gone and the break is moot, so return 0; oplock_break() treats
that as success and runs the normal teardown.

Published: 2026-06-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the SMB server component ksmbd contains a race condition that allows a concurrent SMB2 LOGOFF to clear the opinfo->conn pointer while oplock/lease break notifiers are running. The notifiers read this pointer without a NULL check, causing a null pointer dereference that triggers a kernel oops and system crash. The flaw results in a denial of service; no evidence in the description indicates arbitrary code execution.

Affected Systems

All Linux kernels that incorporate the upstream ksmbd implementation without the patch are affected. No version range is specified, so any build of the kernel that has not applied the referenced commit is vulnerable.

Risk and Exploitability

Exploitation is possible remotely by a malicious SMB client that sequences lease or oplock requests with a LOGOFF to produce the race. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw causes a kernel oops, an attacker can terminate the system, disrupting availability. There is no confirmed privilege escalation path beyond the crash, but the high impact and lack of mitigations make the risk significant.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8df4bcdb0a4232192b2445256c39b787d58ef14d`	affected	< 945a86b21b40fb17183f5b27461baa6f03e2467f
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< 1ff58dcfcab434ebb51649da33774fbb8e1f7b67
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< e735dbd489e3ea02be78dba991056fe1138be51e
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< 75e33deda658c1ab3a9336cbdb1436536f9b3660
`c8efcc786146a951091588e5fa7e3c754850cb3c`	affected	< b003086d76968298f22e7cf62239833b5a3a06b1
`6.6.32`	affected	< 6.6.143

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8df4bcdb0a4232192b2445256c39b787d58ef14d,945a86b21b40fb17183f5b27461baa6f03e2467f)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,1ff58dcfcab434ebb51649da33774fbb8e1f7b67)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,e735dbd489e3ea02be78dba991056fe1138be51e)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,75e33deda658c1ab3a9336cbdb1436536f9b3660)`	affected	code_commit	—
`[c8efcc786146a951091588e5fa7e3c754850cb3c,b003086d76968298f22e7cf62239833b5a3a06b1)`	affected	code_commit	—
`[6.6.32,6.6.143)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	semver	—
`[0,6.9)`	unaffected	semver	—
`[6.6.143,7.0.0]`	unaffected	semver	—
`[6.12.94,7.0.0]`	unaffected	semver	—
`[6.18.36,7.0.0]`	unaffected	semver	—
`[7.0.13,8.0.0]`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the ksmbd patch and apply the update through your distribution’s package manager.
If a kernel update cannot be applied immediately, manually apply the commit that adds NULL checks to ksmbd’s oplock/lease break notifiers—pull the referenced patch and rebuild the kernel.
Restrict SMB traffic to trusted sources or disable oplock/lease handling in the SMB server configuration if the feature is not essential.

Generated by OpenCVE AI on June 25, 2026 at 12:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00119.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67
https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660
https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467f
https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1
https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51e
https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53271-711f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53271
https://www.cve.org/CVERecord?id=CVE-2026-53271

History

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062518-CVE-2026-53271-711f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53271 https://www.cve.org/CVERecord?id=CVE-2026-53271

Thu, 25 Jun 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-872

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops. Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown.
Title		ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67 https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660 https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467f https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1 https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:56.489Z

Updated: 2026-06-25T08:39:56.489Z

Reserved: 2026-06-09T07:44:35.395Z

Link: CVE-2026-53271

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53271 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-25T19:15:16Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-872

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object