CVE-2026-53271 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
A remote attacker can cause a kernel crash in ksmbd by triggering a race condition during oplock or lease break notifications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53271?
CVE-2026-53271 is a medium-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops.
Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown.
Weakness: CWE-476
Which versions are affected by CVE-2026-53271?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53271?
Apply the vendor's patch.
Is CVE-2026-53271 being exploited?
There is no known exploitation of CVE-2026-53271 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53271, DEBIAN-CVE-2026-53271, GHSA-hxmm-jmj9-253j, UBUNTU-CVE-2026-53271.