NULL pointer dereference in Linux kernel - CVE-2026-53271
Published: June 26, 2026
Vulnerability identifier: #VU135475
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-53271
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in smb2_oplock_break_noti() and smb2_lease_break_noti() in fs/smb/server/oplock.c when handling oplock or lease break notifications during a concurrent SMB2 LOGOFF. A remote attacker can trigger a concurrent logoff condition to cause a denial of service.
The issue is remotely triggerable and results in a kernel oops when ksmbd_conn_r_count_inc(conn) dereferences a NULL connection pointer.
How to mitigate CVE-2026-53271
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67
- https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660
- https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467f
- https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1
- https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51e