The Linux kernel’s ksmbd module contains a use‑after‑free flaw: it frees the oplock_info structure with kfree() while still being accessed under RCU read‑side critical sections in functions such as opinfo_get() and proc_show_files(). Because no RCU grace period is observed before freeing the memory, a reader can dereference oplock_info after it has been released, potentially corrupting kernel memory and enabling privileged code execution or escalation. The weakness is classified as CWE‑763.

All Linux kernel releases before the commit that replaces the immediate kfree() call with call_rcu() for oplock_info are affected. The product is the Linux kernel, across all vendors (Linux:Linux), with no specific version ranges listed in the CVE data.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no documented widespread exploitation to date. The likely attack vector is a remote SMB request to a ksmbd‑enabled host; however, this is inferred from the nature of the module rather than explicitly stated. Successful exploitation would grant kernel privilege escalation, so the overall risk remains high though the exploitation likelihood appears low based on current evidence.