Executive brief
A vulnerability in the Linux kernel's ksmbd component, which provides SMB file sharing services, could allow a remote attacker to crash the system. By initiating a specific sequence of network commands, such as logging off while a file lock notification is pending, an attacker can trigger a system failure (kernel oops). This results in a denial-of-service condition, impacting the availability of the file server and any hosted applications.
Technical details
A race condition exists in the ksmbd component of the Linux kernel within fs/smb/server/oplock.c. Specifically, smb2_oplock_break_noti() and smb2_lease_break_noti() fail to perform a NULL check or use READ_ONCE() when accessing opinfo->conn. Because these functions run after dropping the ci->m_lock, a concurrent SMB2 LOGOFF can set the connection pointer to NULL. This results in a NULL pointer dereference when ksmbd_conn_r_count_inc(conn) attempts to write to an offset of the NULL pointer, causing a kernel oops. The issue is remotely triggerable by an authenticated user or a user capable of initiating SMB sessions. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.6.32 to 6.6.143, 6.9 to 7.1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/1ff58dcfcab434ebb51649da33774fbb8e1f7b67
- https://git.kernel.org/stable/c/75e33deda658c1ab3a9336cbdb1436536f9b3660
- https://git.kernel.org/stable/c/945a86b21b40fb17183f5b27461baa6f03e2467f
- https://git.kernel.org/stable/c/b003086d76968298f22e7cf62239833b5a3a06b1
- https://git.kernel.org/stable/c/e735dbd489e3ea02be78dba991056fe1138be51e