The kernel’s ksmbd component contains a reference count leak when a session lookup finds a session whose state is not SMB2_SESSION_VALID. The missing decrement means that each such invalid session retains a reference that is never released. Over time, repeated processing of invalid sessions can cause a buildup of unreleased session objects in kernel memory, which may lead to resource exhaustion. This weakness is a form of resource management flaw.

The flaw affects Linux kernel builds that include ksmbd, specifically kernel versions 6.13 through 6.13‑rc7 and the 6.19‑rc1 release as indicated by the listed kernel versions. Systems running these kernels with ksmbd enabled are vulnerable, regardless of distribution. The vulnerability is tied to the ksmbd service, the SMB server implementation within the kernel.

The CVSS score of 7.5 represents a high severity vulnerability. The EPSS score of less than 1% indicates a low probability that the flaw will be actively exploited. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to send SMB traffic that triggers a ksmbd session lookup on an invalid session to potentially exploit the flaw. No publicly available exploits have been disclosed.