In the Linux kernel’s ksmbd Samba service, a use‑after‑free flaw is introduced during Kerberos authentication. After a user session is freed, another concurrent thread may still dereference the previously freed sess->user pointer, leading to memory corruption that could be manipulated to run arbitrary code. The vulnerability is categorized under CWE‑416, indicating a classic use‑after‑free scenario.

The flaw affects Linux kernels that include the ksmbd service, notably versions 6.15 release candidates 1 through 4 and all builds based on the 6.15 series. Debian snapshot 11.0 kernels are also impacted as they package the 6.15 code. Any distribution that ships an unpatched copy of the kernel is vulnerable.

The CVSS score is 9.8, reflecting a high severity and a high likelihood of exploitation. EPSS is reported as < 1 %, meaning the overall probability of an observed exploit is currently very low, though the flaw remains exfiltration‐ready. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation would require a concurrent thread accessing the freed memory, suggesting that a privileged or remote attacker could trigger the flaw by interacting with the SMB service, potentially giving them complete control of the host.