CVE-2026-68381

This is a use-after-free in ksmbd's async oplock and lease break notification paths. The bug isn't that developers forgot to pin the connection struct — it's that they used r_count as a lifetime guard when r_count was never designed for that purpose. r_count tracks pending operations for flow control; it gates teardown to prevent premature shutdown while requests are in flight, but it doesn't hold a reference. The connection struct can be freed while async work referencing it is still queued. The work->conn pattern is the systemic vulnerability. Passing a raw struct pointer through an async work queue, without any type-level enforcement of reference ownership, creates a lifetime puzzle every caller must solve correctly. Developers working on oplock break notifications are thinking about SMB protocol semantics, not connection teardown races. The attention fragmentation is the real bug — the code looks reasonable because the semantic contract was never explicit. The fix adds ksmbd_conn_get() before queueing the work and ksmbd_conn_put() after completion — a real reference where a logical counter was misapplied. Audit other work->conn callers for the same pattern; if r_count was trusted for lifetime elsewhere, that's likely the same bug. The CVSS 9.8 reflects kernel heap corruption severity, but the exploitability window is narrow — a race during connection teardown triggered by specific async paths. Prioritize the patch, but recognize this is a design-level flaw in how ksmbd passes connection state to async workers, not an isolated oversight.

Reviewed through automated stages and approved by a human before publication.