{"id":"CVE-2026-68381","title":"ksmbd: pin conn during async oplock break notification","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: pin conn during async oplock break notification\n\nsmb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn\npointer in an async ksmbd_work and then …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 09aeab68033161cb54f194da93e51a11aee6144b < 0f72fc9659d7f585460d43c158055df5afdcffb6","Linux >= a4261bbc33fbf99b99c80aa3a2c5097611802980 < 793e1c7041b93af96ff87e678329bc16aee7ba88","Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < 6ecb252efa0b413ac3d9979fb4eec247f8fc1258","Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < 14062c74e5b25c27edcff7a2fe0dc701c930b372","Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9","Linux f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa","Linux >= 6.6.84 < 6.6.148","Linux >= 6.12.20 < 6.12.101","Linux >= 6.13.8 < 6.14","Linux 6.14"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:47:40.959770Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:10.255Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68381","references":[{"url":"https://git.kernel.org/stable/c/0f72fc9659d7f585460d43c158055df5afdcffb6"},{"url":"https://git.kernel.org/stable/c/793e1c7041b93af96ff87e678329bc16aee7ba88"},{"url":"https://git.kernel.org/stable/c/6ecb252efa0b413ac3d9979fb4eec247f8fc1258"},{"url":"https://git.kernel.org/stable/c/14062c74e5b25c27edcff7a2fe0dc701c930b372"},{"url":"https://git.kernel.org/stable/c/aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9"}],"tags":["cve.org"],"epss":0.00457,"epssPercentile":0.38206,"ingestedAt":"2026-10-16T17:24:46.864Z","slug":"CVE-2026-68381","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: pin conn during async oplock break notification\n\nsmb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn\npointer in an async ksmbd_work and then queue that work on ksmbd-io.  The\nwork only increments conn->r_count, which prevents teardown from passing\nthe pending-request wait after the increment, but it does not pin the\nstruct ksmbd_conn object.\n\nIf connection teardown races with an oplock break notification, the last\nconn reference can be dropped before the queued worker finishes.  The\nworker then uses the freed conn in ksmbd_conn_write() and\nksmbd_conn_r_count_dec().\n\nTake a real conn reference when publishing the conn pointer to the async\nwork item, and drop it after the notification work has decremented\nr_count.  Apply the same lifetime rule to lease break notification, which\nuses the same work->conn pattern.\n\n## Affected\n\n- `Linux >= 09aeab68033161cb54f194da93e51a11aee6144b < 0f72fc9659d7f585460d43c158055df5afdcffb6`\n- `Linux >= a4261bbc33fbf99b99c80aa3a2c5097611802980 < 793e1c7041b93af96ff87e678329bc16aee7ba88`\n- `Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < 6ecb252efa0b413ac3d9979fb4eec247f8fc1258`\n- `Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < 14062c74e5b25c27edcff7a2fe0dc701c930b372`\n- `Linux >= 3aa660c059240e0c795217182cf7df32909dd917 < aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9`\n- `Linux f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa`\n- `Linux >= 6.6.84 < 6.6.148`\n- `Linux >= 6.12.20 < 6.12.101`\n- `Linux >= 6.13.8 < 6.14`\n- `Linux 6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}