A race condition in the Linux kernel’s SMB daemon, ksmbd, allows a lock entry to be removed from a connection’s list while holding a mutex that does not protect that list. When SMB3 multichannel connections are in use, the connection that issues the lock request can differ from the one that opened the file, so the removal can occur under an incorrect lock. A concurrent traversal can then access freed lock structures, leading to kernel memory corruption. The description indicates a use‑after‑free race that could enable arbitrary code execution with kernel privileges, but this is inferred from the data.

All Linux kernel configurations that include the ksmbd SMB server are at risk. The CNA lists the vendors as Linux:Linux, and the patch commit noted in the references (22d38cf75…) is the first fix; any kernel release prior to that commit may be vulnerable. The exact affected releases are not enumerated in the provided data.

The likely attack vector is inferred to be a malicious SMB client that sends crafted lock requests to a target supporting SMB multichannel connections, based on the description of the faulty lock handling during SMB3 operations. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw can silently corrupt kernel memory and potentially grant privilege escalation, which is inferred from the described memory corruption, the vulnerability should be treated with urgency.