The kernel’s ksmbd component contains a reference count leak when a session lookup finds a session whose state is not SMB2_SESSION_VALID. The missing decrement means that each such invalid session retains a reference that is never released. Over time, repeated processing of invalid sessions can cause a buildup of unreleased session objects in kernel memory, which may lead to resource exhaustion.

The flaw affects Linux kernel builds that include ksmbd, specifically kernel versions 6.13 through 6.13‑rc7 and the 6.19‑rc1 release as indicated by the CPE list. Systems running these kernels with ksmbd enabled are vulnerable, regardless of distribution. The vulnerability is tied to the ksmbd service, the SMB server implementation within the kernel.

The CVSS score of 5.5 signals a medium severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred that an attacker would need to send SMB traffic that triggers a ksmbd session lookup on an invalid session to exploit the flaw. No publicly available exploits have been disclosed.