In the Linux kernel’s SMB server component, an error path for SMB2_SESSION_SETUP requests that include the binding flag fails to clear the per‑connection binding indicator. The leftover flag causes subsequent session‑lookup functions to fall back to a global table rather than the per‑connection context, which can result in incorrect session matching and potential resource exhaustion. This flaw reflects a failure to handle an error condition (CWE‑390) and could be leveraged by an attacker to disrupt SMB services or consume kernel resources. The impact is confined to systems running a kernel that has not yet incorporated the patch that resets the binding flag.

All Linux kernel installations that include the ksmbd SMB server are affected; no specific kernel releases are enumerated, indicating that any unfixed kernel could be vulnerable. This includes standard distributions whose kernels expose SMB port 445.

The CVSS score of 8.8 classifies the issue as high severity, yet the EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest that exploitation is currently unlikely. The likely attack vector involves sending a malformed SMB2 request to a publicly reachable ksmbd instance; success would force the server into a repeated misclassification of session lookups, potentially leading to denial of service. No publicly demonstrated exploit is known, but the vulnerability remains relevant if the service is exposed.