A race condition exists in the Linux kernel’s ksmbd component that allows a session to be freed before it is fully registered in the channel list. This results in a use‑after‑free situation, which can corrupt kernel memory. Though the description does not specify a concrete exploit, such memory corruption can enable an attacker to gain privileged access or cause a denial of service.

The vulnerability affects the Linux kernel as used by Debian Linux 11.0 and by any Linux system running a kernel version that has not been patched for the ksmbd session use‑after‑free. The official references list commits that address the issue, indicating that only kernels prior to those patches are vulnerable.

The CVSS score of 8.8 indicates a high severity impact. The EPSS score of less than 1 % suggests that the likelihood of exploitation is low, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is inferred to be local or requires the ability to send specially crafted SMB requests to the affected server, enabling a race condition that results in the memory corruption described above.