CVE-2026-53271

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn

into a local with neither READ_ONCE() nor a NULL check. Both run from

oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a

concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL

under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then

writes through NULL at offset 0xc4 -- a remotely triggerable oops.

Guard both reads the way compare_guid_key() already does: read

opinfo->conn with READ_ONCE() and return early if it is NULL, before

allocating the work struct so nothing leaks. A NULL conn means the

client is gone and the break is moot, so return 0; oplock_break() treats

that as success and runs the normal teardown.