The vulnerability arises when the ksmbd path removal function is not invoked on some error branches within the Linux kernel. This omission can leave inode locks and references unreleased, resulting in deadlocks or leaked locks that are detected as “workqueue leaked lock” errors. Based on the description, it is inferred that an attacker with sufficient access to trigger these error paths could destabilize the system, leading to kernel panics, unresponsive services or degraded performance. The weakness pertains to improper synchronization and resource deallocation, classifying it as a deadlock scenario (CWE-503).

All Linux kernels that incorporate the ksmbd module are affected, particularly those using older releases prior to the patch that added ksmbd_vfs_kern_path_end_removing() calls on error paths. The CPE identifies the linux_kernel; specific version details are not listed in the CVE data. Vendor distributions that have not yet applied the patch to their kernel package remain vulnerable.

No CVSS or EPSS scores are available for this entry, and the vulnerability is not listed in CISA’s KEV catalog. The risk remains uncertain. Based on the description, it is inferred that an attacker able to trigger the problematic paths could crash or destabilize kernel workqueues, potentially enabling denial of service or facilitating further escalation. The likely attack vector is inferred to involve provoking kernel faults through malformed SMB requests or other interactions with ksmbd, requiring that the target system has ksmbd enabled.