A use‑after‑free bug in the Linux kernel’s ksmbd module enables a NULL pointer dereference during asynchronous cryptographic operations with the Qualcomm Crypto Engine; the bug is triggered when the engine returns -EINPROGRESS and ksmbd treats it as an error, freeing the request before the DMA completion callback executes. This flaw can cause a kernel panic, leading to a denial of service on the affected system.

The vulnerability impacts Linux kernel images that include the ksmbd module and support the Qualcomm Crypto Engine. No specific kernel version range is indicated in the available data, so any kernel build using ksmbd and the Qualcomm engine is potentially affected.

The flaw results only in a system crash and does not provide remote code execution or data exfiltration. The CVSS score is not available, but the nature of the bug suggests moderate to high severity in terms of availability impact. Local users with the ability to trigger ksmbd’s crypto path, or remote users who can interact with the SMB server, could potentially exploit the crash; however, the exact attack vector is not explicitly documented, so its likelihood and exploitability remain uncertain. The vulnerability is not listed in CISA’s KEV catalog and no EPSS score is present.