A use‑after‑free in the Linux kernel's ksmbd SMB server allows a freed share configuration to be accessed again after a SMB2_TREE_DISCONNECT operation. The missing validation of the tree connection state permits the kernel to dereference memory that has already been freed, resulting in a kernel panic as confirmed by KASAN logs. This leads to a complete system stop and loss of service for any process depending on the kernel.

The vulnerability exists in any Linux kernel that implements the ksmbd component prior to the commit that introduced the missing state check. Current distributions that have not yet applied the patch are potentially affected; no specific version numbers are provided in the supplied data.

The flaw can be triggered by an SMB client that sends a compound request containing a TREE_DISCONNECT followed by additional SMB commands. This scenario is straightforward for an attacker with network access to the affected machine. Although no public exploit is documented and the EPSS score is unavailable, the high impact of a kernel crash and the ease of constructing the required SMB traffic make the risk significant for unpatched systems. The vulnerability is not yet listed in the CISA KEV catalog.