The Linux kernel’s ksmbd service contains a flaw in its durable reconnect logic where a file descriptor that has already been republished into a session table can be released twice. The first release drops a reference used for reconnection tracking; a second, unconditional release calls a session‑agnostic close routine that frees the file object while the session’s volatile‑id entry still points to it. This use‑after‑free can corrupt memory or crash the kernel, and if an attacker can trigger the code path, the fault could lead to arbitrary code execution.

All Linux kernel installations that include the ksmbd daemon and have not yet integrated the fix from the commit series that introduced ksmbd_reopen_durable_fd adjustments. The patch was published in mid‑2026, so any kernel built from source or binary packages before that date remains vulnerable.

The CVSS score of 9.8 denotes a critical severity, while the EPSS score of < 1% indicates a low probability of exploitation. An attacker would need to interact with the vulnerable machine over SMB, inducing the double release path. Successful exploitation could cause denial of service or remote code execution if memory corruption is leveraged.