CVE-2026-53271: Linux ksmbd NULL Pointer Dereference in Oplock/Lease Break Handlers

Technical summary

CVE-2026-53271 is a NULL pointer dereference vulnerability in the Linux kernel's ksmbd SMB server implementation, specifically in the oplock and lease break notification handlers (smb2_oplock_break_noti and smb2_lease_break_noti). The vulnerability arises from a time-of-check-time-of-use (TOCTOU) race condition: after opinfo_get_list() releases the ci->m_lock lock, a concurrent SMB2 LOGOFF request can set opinfo->conn to NULL via session_fd_check(). The notification handlers read opinfo->conn without READ_ONCE() semantics or NULL validation, then pass it unsafely to ksmbd_conn_r_count_inc(), which dereferences at offset 0xc4, causing a kernel oops. The fix guards both code paths with READ_ONCE() and an early NULL check, returning success (0) if the connection has been torn down, as the break notification becomes moot at that point.

Business impact

This vulnerability enables local denial-of-service attacks against systems running vulnerable Linux kernels with ksmbd enabled. While ksmbd is primarily used in server environments providing SMB/CIFS file sharing (particularly in embedded devices and non-x86 systems), any kernel crash degrades availability. In production NAS appliances, edge servers, or containerized deployments where ksmbd is active, a single authenticated session can repeatedly crash the service. The attack requires local or network access to establish an SMB session, but does not compromise confidentiality or integrity—impact is limited to availability.

Affected systems

Any Linux system with ksmbd (kernel SMB server) enabled and running a vulnerable kernel version is affected. ksmbd is not enabled by default in most distributions but is present in appliances, NAS devices, and specialized embedded systems. The vulnerability requires local or network-based SMB access; the attacker must be able to establish an authenticated SMB session and then trigger a concurrent LOGOFF during oplock break processing. Exact vulnerable kernel versions should be verified against vendor advisories and your kernel build configuration.

Exploitability

The vulnerability is exploitable but requires specific conditions: the attacker needs network or local access to initiate an SMB session to the ksmbd server, and must time a LOGOFF request to race with ongoing oplock or lease break notification processing. The race window is relatively narrow but feasible to trigger reliably in most network conditions. No special privileges, exploit code, or user interaction are required beyond establishing a session. The attack is reproducible and does not require kernel ASLR bypass or other mitigations to be bypassed, making it straightforward for a motivated threat actor with network access.

Remediation

Apply a kernel patch that incorporates the fix: guard reads of opinfo->conn in both smb2_oplock_break_noti() and smb2_lease_break_noti() using READ_ONCE() and validate the pointer before use. If the connection is NULL, return early with success (0), as the break notification is no longer valid. Alternatively, if patching cannot be performed immediately, disable ksmbd (via CONFIG_SMB_SERVER=n at build time or by unloading the module) in environments where SMB server functionality is not required. Monitor for kernel panics in ksmbd-related stack traces as a detection signal.

Patch guidance

Patches for this vulnerability will be integrated into stable Linux kernel releases following upstream kernel development timelines. Users should monitor their distribution's security advisories for backported fixes. Verify patch application by confirming the presence of READ_ONCE() guards and NULL checks in the smb2_oplock_break_noti and smb2_lease_break_noti functions. If you maintain a custom kernel, cherry-pick the upstream fix commit once it is publicly available. Test patched kernels thoroughly in non-production environments before deployment, as SMB server behavior changes can affect existing file-sharing workloads.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for NULL pointer dereference oops messages involving ksmbd, particularly mentioning smb2_oplock_break_noti, smb2_lease_break_noti, or ksmbd_conn_r_count_inc in the stack trace. Correlation with rapid SMB session connect/disconnect patterns may indicate active exploitation attempts. Deploy kernel panic detection and alerting to catch abnormal system-level failures. If SMB server activity is not expected in your environment, monitor for unexpected ksmbd module loading or SMB port activity (445/TCP) on systems where it should be disabled.

Why prioritize this

Although severity is MEDIUM (CVSS 5.5), prioritization should account for your specific environment. If ksmbd is active in production systems (NAS devices, edge appliances, or specialized servers), this vulnerability should be patched urgently because reliable exploitation causes service outages. For standard enterprise Linux workstations and servers where ksmbd is typically disabled, risk is lower but patching remains important for defense-in-depth. The lack of KEV (CISA Known Exploited Vulnerabilities) status does not minimize local exploitation risk; it reflects current public awareness rather than true risk.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector requiring valid SMB session credentials, no impact to confidentiality or integrity, and only high availability impact. The local attack vector (AV:L) constrains score even though the vulnerability is network-reachable via SMB. In practice, if ksmbd is exposed to untrusted networks or used in multi-tenant environments, effective risk is higher. Organizations should adjust their internal risk rating upward if ksmbd is internet-facing or if your threat model includes disgruntled users with local/SMB access.

Frequently asked questions