An attacker can trigger a null pointer dereference in the ksmbd subsystem’s compare_guid_key() function when a stale lease entry is referenced after a session closure. The vulnerability occurs when a TCP connection that previously negotiated a SMB2 lease is closed and immediately reopened with a session that uses the same ClientGUID, causing the kernel to dereference a NULL connection pointer during lease lookup. This bug leads to a kernel panic and a denial of service on the affected host. The flaw is a classic CWE‑476 NULL pointer dereference.

The CVE data lists the Linux kernel as the affected platform but provides no specific version range. Any kernel that includes the ksmbd module with durable handle support and has not yet integrated the patch commit is potentially vulnerable. Users should assume that any distribution containing ksmbd and durable handles is at risk until the fix is applied.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to initiate SMB traffic that follows a specific pattern: establish an SMB session, negotiate a lease context, close the session, and immediately open a new session with the same ClientGUID while requesting a lease on a different inode. The required protocol interaction and stateful conditions make widespread exploitation unlikely at present. However, the kernel crash resulting from the null dereference would abruptly terminate all system processes, effectively denying service.