CVE-2026-53271

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix NULL-deref of opinfo-&gt;conn in oplock/lease break notifiers<br /> <br /> smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo-&gt;conn<br /> into a local with neither READ_ONCE() nor a NULL check. Both run from<br /> oplock_break() after opinfo_get_list() has dropped ci-&gt;m_lock, so a<br /> concurrent SMB2 LOGOFF (session_fd_check()) can set op-&gt;conn = NULL<br /> under ci-&gt;m_lock within that window. ksmbd_conn_r_count_inc(conn) then<br /> writes through NULL at offset 0xc4 -- a remotely triggerable oops.<br /> <br /> Guard both reads the way compare_guid_key() already does: read<br /> opinfo-&gt;conn with READ_ONCE() and return early if it is NULL, before<br /> allocating the work struct so nothing leaks. A NULL conn means the<br /> client is gone and the break is moot, so return 0; oplock_break() treats<br /> that as success and runs the normal teardown.