CVE-2026-68381

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: pin conn during async oplock break notification

smb2oplockbreaknoti() and smb2leasebreaknoti() store a ksmbd_conn

pointer in an async ksmbd_work and then queue that work on ksmbd-io.  The

work only increments conn->r_count, which prevents teardown from passing

the pending-request wait after the increment, but it does not pin the

struct ksmbd_conn object.

If connection teardown races with an oplock break notification, the last

conn reference can be dropped before the queued worker finishes.  The

worker then uses the freed conn in ksmbdconnwrite() and

ksmbdconnrcountdec().

Take a real conn reference when publishing the conn pointer to the async

work item, and drop it after the notification work has decremented

r_count.  Apply the same lifetime rule to lease break notification, which

uses the same work->conn pattern.