This flaw exists in the Linux kernel’s ksmbd SMB server during the oplock grant sequence. A use‑after‑free occurs when a newly created operation information (opinfo) object is freed while still linked in a global list, causing concurrent readers to dereference memory that has already been released. A separate NULL pointer dereference happens when the same opinfo’s file pointer is still NULL while a lease‑lookup routine accesses its fields. These kernel‑level memory corruption bugs could allow an attacker to destabilize the system or corrupt critical data structures, potentially leading to remote code execution or privilege escalation.

All Linux kernel builds that contain the ksmbd code path prior to the fix commit are affected. No specific kernel version numbers are listed in the advisory; therefore, the vulnerability applies to every kernel that was built from mainline before the publication of the corrective changes.

The CVSS score of 9.8 indicates a severe issue, while the EPSS score of < 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is SMB traffic entering the kernel’s ksmbd service; an attacker directing crafted SMB requests could trigger the bad memory accesses. Although the CVE entry only implies that such an exploit could lead to remote code execution, the potential for kernel compromise is clear.