A race condition in the Linux kernel’s SMB daemon, ksmbd, allows a lock entry to be removed from a connection’s list while holding a mutex that does not protect that list. When SMB3 multichannel connections are in use, the connection that issues the lock request can differ from the one that opened the file, so the removal can occur under an incorrect lock. A concurrent traversal can then access freed lock structures, leading to kernel memory corruption. The vulnerability is a classic use‑after‑free race, which could enable an attacker to execute arbitrary code with kernel privileges.

All Linux kernel configurations that include the ksmbd SMB server are susceptible. The CNA lists the vendors as Linux:Linux, and no specific kernel release is identified, implying that any distribution with the kernel before the upstream patch commit (22d38cf75…) may be affected. The exact affected releases are not enumerated in the provided data.

The likely attack vector is a malicious SMB client that sends crafted lock requests to a target supporting SMB multichannel connections; this inference is drawn from the description of the faulty lock handling during SMB3 operations. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw can silently corrupt kernel memory and potentially grant privilege escalation, the vulnerability should be treated with urgency.