A race condition in the Linux kernel’s ksmbd IPC implementation allows an attacker to trigger a use‑after‑free during concurrent message processing. ipc_msg_send_request waits for a generic netlink reply using a stack‑allocated entry, while the handler handle_response fills entry->response without holding the same lock. Under high concurrency the handler may copy data into entry->response while ipc_msg_send_request has freed it, causing a slab‑use‑after‑free reported by KASAN. This leads to kernel memory corruption. Based on the use‑after‑free, it is inferred that an attacker could potentially execute arbitrary code in kernel context, although the CVE description does not explicitly state such exploitation.

All Linux kernel releases that contain the ksmbd user‑space facility. The CVE applies to any system running the Linux kernel with ksmbd enabled; no specific version range is listed, so any kernel before the patch that reverts this race is vulnerable. All vendors shipping the stock kernel should be considered impacted.

The CVSS score of 9.8 indicates critical severity. EPSS is below 1 %, suggesting a low probability of real‑world exploitation at present. The vulnerability is not listed in CISA KEV, implying no publicly known exploits yet. The likely attack vector is inferred to be network‑based via SMB traffic to a host with ksmbd enabled. Exploiting the race condition may require a sustained or coordinated burst of messages; the specific prerequisites are not detailed in the description and are inferred.