The Linux kernel’s SMB daemon, ksmbd, contains an unsynchronized access to the ksmbd_chann_list xarray. When a channel is looked up with lookup_chann_list() and then deleted with ksmbd_chann_del(), the xarray may be freed while the lookup still holds a reference, causing a use‑after‑free. This memory corruption can allow an attacker who can influence SMB channel creation to execute arbitrary code in kernel space, potentially escalating privileges or causing a kernel panic. The fix introduces a read‑write semaphore, chann_lock, to serialize all xa_load/xa_store/xa_erase operations and eliminate the race.

The vulnerability affects the Linux kernel, specifically the ksmbd SMB daemon present in all distributions that ship a kernel containing this module. No specific version range is provided, but the issue was resolved in recent kernel commits, so any kernel built from those commits onward is protected.

The flaw carries a high CVSS score of 8.8 yet has an EPSS score below 1%, indicating a low current exploitation probability. It is not listed in the CISA KEV catalog. Inferred from the affected component, the attack vector is likely remote via SMB or local through privileged processes that can create SMB channels. Because there is no official workaround, the only viable mitigation is to apply the kernel update or disable the affected service.