CVSS 5.5 · Medium EPSS 0,11%
Kerentanan NULL Pointer Dereference pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops. Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 6.6.32 hingga sebelum 6.6.143 |
| linux | linux kernel | Versi 6.9 hingga sebelum 6.12.94 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.18.36 |
| linux | linux kernel | Versi 6.19 hingga sebelum 7.0.13 |
| linux | linux kernel | Versi 7.1 rc1 |
| linux | linux kernel | Versi 7.1 rc2 |
| linux | linux kernel | Versi 7.1 rc3 |
| linux | linux kernel | Versi 7.1 rc4 |
| linux | linux kernel | Versi 7.1 rc5 |
| linux | linux kernel | Versi 7.1 rc6 |