A NULL pointer dereference vulnerability exists in the Linux kernel's ksmbd component related to oplock and lease break notifiers. (CVE-2026-53271)
A NULL pointer dereference vulnerability exists in the Linux kernel's ksmbd component related to oplock and lease break notifiers. The functions smb2_oplock_break_noti() and smb2_lease_break_noti() read a connection pointer without proper synchronization or NULL checks, which can lead to a NULL pointer dereference and kernel oops. This occurs due to a race condition with SMB2 LOGOFF operations. The issue has been fixed by adding proper READ_ONCE() usage and NULL checks before proceeding with work allocation.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel ksmbd subsystem involves improper handling of the opinfo->conn pointer in oplock and lease break notifier functions. These functions read the pointer without atomic access or NULL checks, leading to a potential NULL pointer dereference when a concurrent SMB2 LOGOFF clears the connection pointer. This results in a kernel oops triggered remotely. The fix involves guarding the pointer reads with READ_ONCE() and returning early if the pointer is NULL, preventing use-after-free or NULL dereference conditions.
Potential Impact
Successful exploitation causes a NULL pointer dereference in the kernel, leading to a kernel oops and denial of service (system crash). There is no indication of confidentiality or integrity impact. The vulnerability requires local access (AV:L) with low privileges (PR:L) and no user interaction. The attack complexity is low, but the impact is limited to availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix has been implemented in the Linux kernel source code by adding READ_ONCE() and NULL checks. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available.
A NULL pointer dereference vulnerability exists in the Linux kernel's ksmbd component related to oplock and lease break notifiers. (CVE-2026-53271)
Description
A NULL pointer dereference vulnerability exists in the Linux kernel's ksmbd component related to oplock and lease break notifiers. The functions smb2_oplock_break_noti() and smb2_lease_break_noti() read a connection pointer without proper synchronization or NULL checks, which can lead to a NULL pointer dereference and kernel oops. This occurs due to a race condition with SMB2 LOGOFF operations. The issue has been fixed by adding proper READ_ONCE() usage and NULL checks before proceeding with work allocation.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel ksmbd subsystem involves improper handling of the opinfo->conn pointer in oplock and lease break notifier functions. These functions read the pointer without atomic access or NULL checks, leading to a potential NULL pointer dereference when a concurrent SMB2 LOGOFF clears the connection pointer. This results in a kernel oops triggered remotely. The fix involves guarding the pointer reads with READ_ONCE() and returning early if the pointer is NULL, preventing use-after-free or NULL dereference conditions.
Potential Impact
Successful exploitation causes a NULL pointer dereference in the kernel, leading to a kernel oops and denial of service (system crash). There is no indication of confidentiality or integrity impact. The vulnerability requires local access (AV:L) with low privileges (PR:L) and no user interaction. The attack complexity is low, but the impact is limited to availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix has been implemented in the Linux kernel source code by adding READ_ONCE() and NULL checks. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hxmm-jmj9-253j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53271"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4e4edac9d9e3dbe328862d
Added to database: 07/08/2026, 13:21:30 UTC
Last enriched: 07/08/2026, 13:32:41 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.