CVE-2026-68381

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where smb2 oplock break noti() and smb2 lease break noti() store a ksmbd conn pointer in an async ksmbd work and queue it on ksmbd-io. The process only increments conn->r count, which fails to pin the struct ksmbd conn object. If a connection teardown occurs simultaneously with an oplock break notification, the last connection reference may be dropped before the queued worker completes. This leads to a use-after-free scenario where the worker utilizes the freed connection in ksmbd conn write() and ksmbd conn r count dec() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.