The ksmbd service contains a null pointer dereference in the generate_encryptionkey function when a client sends two session setups with krb5 authentication. This flaw causes a kernel fault that can crash the kernel, leading to a denial of service. The weakness is a classic null pointer dereference (CWE-476). No evidence in the description indicates that the fault leads to code execution. The impact is a disruption of the affected host, with potential local or remote availability impact depending on the network exposure of the ksmbd service.

The vulnerability affects all Linux kernel implementations that include the ksmbd service before the patch, including Debian Linux 11.0 and any other Linux kernel distribution. The CPE strings list Debian 11.0 and the generic Linux kernel namespace, indicating that any system running ksmbd prior to the fix is susceptible.

The CVSS score of 5.5 reflects a moderate impact, and the EPSS score of < 1% shows a very low probability of exploitation in the wild. Linux is not listed in the CISA KEV catalog. The likely attack vector is a remote SMB client that can trigger the vulnerability by initiating two krb5‑authenticated session setups. An attacker could force the kernel to crash and potentially disrupt service availability on the target host.