The Linux kernel includes a race condition in the ksmbd SMB server component that can cause type confusion between IPC messages. When req->handle values overlap, an attacker can trick the system into reading or writing unintended memory locations, potentially leading to data corruption or arbitrary code execution. The flaw arises because ksmbd fails to correctly validate the type of certain IPC responses.

Vulnerable kernel versions include all Linux kernels up to and including the 6.14 development releases 6.14 rc1 through rc5. The bug is present until the upstream patch is merged into a stable release, and any kernel distribution shipping one of these affected revisions is impacted.

The CVSS score of 8.1 marks this as a high‑severity issue, but the EPSS score of less than 1 percent indicates a low likelihood of widespread exploitation at present. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation would likely require sending specially crafted SMB IPC requests that trigger the race condition, a technique that could be performed remotely against an exposed ksmbd service or locally on a system with privileged access.