A deferred file_lock in the Linux kernel's ksmbd SMB2 handler was freed prematurely while its cancel callback remained registered. A second SMB2_CANCEL request could then trigger the freed callback, resulting in a slab use‑after‑free and kernel memory corruption. An authenticated SMB client can exercise this scenario, potentially crashing the kernel or exploiting the corruption to elevate privileges.

All Linux kernel installations are impacted, as the issue resides in generic ksmbd code for the Linux kernel. Specific version information is not supplied, so any kernel build prior to the inclusion of the documented fix is considered vulnerable.

The vulnerability is a classic use‑after‑free that allows remote memory corruption via the SMB2 protocol. While its EPSS score is not publicly available and it is not in the CISA KEV catalog, the kernel‑level nature of the flaw indicates high severity. An attacker who can reach the SMB service on an affected system can exercise the double SMB2_CANCEL sequence to trigger kernel crash or privilege escalation. No mitigations are indicated in the description beyond applying the patch.