The ksmbd daemon in the Linux kernel does not check that a user reconnecting to a durable handle is the original opener. Because of this, an authenticated user who can predict or brute‑force the persistent identifier could hijack an orphaned handle, gaining access to files opened by another user. This flaw is classified as CWE‑708, indicating a user impersonation weakness.

Any Linux installation running an unpatched mainline kernel that ships with the ksmbd module is affected. Versions prior to the commit that added the durable_owner structure and the ksmbd_vfs_compare_durable_owner validation are vulnerable. All distributions that include those kernel releases without the patch are potentially impacted.

The CVSS score of 8.8 signifies a high severity. With an EPSS score of less than 1% and no listing in CISA’s KEV catalog, there is no evidence of public exploitation. Attackers would need authenticated SMB access and the ability to use durable handles; it is inferred that brute‑forcing the persistent ID is a likely method to hijack a handle, but this inference comes from the description of the vulnerability and is not directly described in the advisory.