This flaw exists in the ksmbd SMB2 implementation of the Linux kernel. It arises from incomplete error handling inside smb2_lock(), where unexpected errors or allocation failures can leak memory or lead to an unconditional NULL dereference of a VFS lock. The resulting kernel crash destabilizes the entire system, providing a classic denial-of-service vector. The weakness is a classic null pointer dereference, mapped to CWE-476.

The affected systems are any Linux kernels that still contain the unpatched ksmbd code. The CPE string lists only the generic Linux kernel, and no particular version range is specified, implying that any kernel revision older than the commit that introduces the patch is likely vulnerable. All distributions shipping that kernel will be exposed until they apply the updated source or a backport.

The CVSS score of 7.5 reflects a high‑impact vulnerability, yet the EPSS score of less than 1% indicates a very low probability of exploitation so far and the issue is not listed in the CISA KEV catalog. The vulnerability requires an attacker to drive the SMB lock path—most plausibly by sending crafted SMB lock/unlock requests—to trigger the fault. This inferred attack vector suggests that remote SMB clients could exploit the flaw, but no public exploit has been reported. Administrators should treat it as a significant risk to service availability and prioritize patching or temporary mitigation.