In the Linux kernel, the ksmbd delete‑on‑close feature performs file unlink and ADS xattr removal using the kernel worker’s credentials instead of the credentials of the user who opened the file. As a result, the unlink and attribute removal bypass normal filesystem permission checks, allowing an authenticated SMB client to delete files and extended attributes that it would normally not be allowed to touch. This flaw provides a privilege escalation path that undermines file system integrity.

The vulnerability resides in the ksmbd subsystem of the Linux kernel. Any distribution running a kernel with ksmbd and that has not applied the patch that corrects the use of opener credentials for delete‑on‑close is affected. The CVE data does not list a specific kernel version, so all releases prior to the fix are potentially vulnerable.

The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, indicating a low current exploitation probability. Nonetheless, the flaw can enable an attacker who can authenticate to an SMB share to delete arbitrary files, creating a high risk to confidentiality, integrity, and availability. Based on the description, it is inferred that the likely attack vector is a remote SMB client that requests delete‑on‑close; the kernel uses the original opener’s credentials at final close, allowing unauthorized deletion despite permission checks.