The Linux kernel’s ksmbd daemon does not verify that the user reconnecting to a durable handle is the original owner of that open. This flaw allows any authenticated user to predict or brute‑force the persistent identifier and hijack an orphaned durable handle, granting them access to the protected file’s contents or the ability to alter it. The defect is a CWE‑708 vulnerability and could be exploited to gain unauthorized access to files via SMBv2.

The vulnerability exists in any Linux installation running an unpatched version of the mainline kernel that contains the ksmbd module. All distributions that ship a kernel without the durable_owner structure and the ksmbd_vfs_compare_durable_owner validation are potentially affected. The fix is provided upstream; users should check against the commit referenced in the supplied Git links.

No EPSS score is available and the issue is not listed in CISA’s KEV catalog, so a quantified severity is not provided. Attacks require authenticated SMB access and the ability to engage durable handles; no public exploits are reported, but the logic that an adversary can brute‑force the persistent ID makes the flaw technically exploitable with moderate effort in environments where durable handles are used for long‑lived file sessions.