A race condition in the Linux kernel SMB component (ksmbd) causes a use‑after‑free when a pointer obtained via rcu_dereference(fp->f_opinfo) is accessed after rcu_read_unlock() has been called. This can result in the kernel dereferencing freed memory and is likely to cause a kernel panic or other unstable behavior.

All Linux kernel builds that include the ksmbd SMB server are potentially affected. The CNA does not list a specific version range, so any kernel version that contains the unpatched ksmbd module could be vulnerable.

The CVSS score and EPSS are not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the race condition occurs in the ksmbd SMB server component and thus the attack vector is likely local or requires initiating SMB traffic to trigger the vulnerable code path. The defect can cause an invalid memory dereference inside the kernel, which typically results in a crash and a denial‑of‑service. No documented exploits provide arbitrary code execution or privilege escalation, so the impact remains limited to instability unless a future exploit is discovered.