Strix
26.1K

CVE-2026-68381

Unknown

Last modified

CVE-2026-68381 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec(). Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 09aeab68033161cb54f194da93e51a11aee6144b, < 0f72fc9659d7f585460d43c158055df5afdcffb6; >= a4261bbc33fbf99b99c80aa3a2c5097611802980, < 793e1c7041b93af96ff87e678329bc16aee7ba88; >= 3aa660c059240e0c795217182cf7df32909dd917, < 6ecb252efa0b413ac3d9979fb4eec247f8fc1258; >= 3aa660c059240e0c795217182cf7df32909dd917, < 14062c74e5b25c27edcff7a2fe0dc701c930b372; >= 3aa660c059240e0c795217182cf7df32909dd917, < aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9; f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa; >= 6.6.84, < 6.6.148; >= 6.12.20, < 6.12.101; >= 6.13.8, < 6.14
LinuxLinux6.14

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-68381?
In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbd_conn_write() and ksmbd_conn_r_count_dec(). Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented r_count. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.
How severe is CVE-2026-68381?
Severity scoring for CVE-2026-68381 is pending analysis.
How do I fix CVE-2026-68381?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-68381?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST