Linux Kernel CVE-2026-53271

ksmbd is the Linux kernel's native SMB server, introduced in kernel 5.15 and present across multiple stable branches (CPE: cpe:2.3:o:linux:linux_kernel). The vulnerable functions smb2_oplock_break_noti() and smb2_lease_break_noti() are invoked from oplock_break() after opinfo_get_list() drops the ci->m_lock spinlock. In that unlocked window, a concurrent SMB2 LOGOFF via session_fd_check() can write NULL into op->conn under ci->m_lock. Neither function used READ_ONCE() nor a NULL check before passing conn to ksmbd_conn_r_count_inc(), which then writes through the NULL pointer at kernel offset 0xc4. CWE-476 (NULL Pointer Dereference) is the root cause class, manifested here as a TOCTOU race - the pointer was valid when checked but invalidated before use. The fix mirrors the pattern already used in compare_guid_key(): read with READ_ONCE() and return early (with 0, indicating success) if NULL, since a NULL conn means the client has disconnected and the break notification is moot.