A use‑after‑free bug exists in the ksmbd file‑handle replay logic. When a durable SMBv2 request is replayed, the kernel over‑writes the connection pointer of an active file handle without proper validation. Subsequent closure of the overwritten connection dereferences a stale pointer, triggering a kernel memory error and potentially causing a crash or a privilege escalation path. The flaw is a classic use‑after‑free vulnerability (CWE‑825).

The vulnerability resides in the Linux kernel, specifically within the ksmbd SMB server module. All kernel builds that include ksmbd are potentially affected, as indicated by the general Linux kernel CPE. No specific version list is included in the CNA data, so the defect may be present in any kernel revision containing the vulnerable code until the patch is applied.

The impact is limited to systems running the vulnerable kernel with the ksmbd service enabled. An attacker would need to initiate or replay SMBv2 durable requests against the target, which suggests a remote attack vector over network traffic. The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. Nevertheless, the denial‑of‑service potential warrants patching as a priority.