CVE-2026-68381

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: pin conn during async oplock break notification

smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn

pointer in an async ksmbd_work and then queue that work on ksmbd-io. The

work only increments conn->r_count, which prevents teardown from passing

the pending-request wait after the increment, but it does not pin the

struct ksmbd_conn object.

If connection teardown races with an oplock break notification, the last

conn reference can be dropped before the queued worker finishes. The

worker then uses the freed conn in ksmbd_conn_write() and

ksmbd_conn_r_count_dec().

Take a real conn reference when publishing the conn pointer to the async

work item, and drop it after the notification work has decremented

r_count. Apply the same lifetime rule to lease break notification, which

uses the same work->conn pattern.