The Linux kernel’s ksmbd SMB2 server processes SET_INFO operations using a credential context that does not match the credentials captured when an SMB handle was opened. Instead of running the entire dispatch with the user’s original credentials, the code performs path‑based VFS helper checks using the ksmbd worker’s credentials. This mismatch could allow an attacker with access to the SMB interface to execute SET_INFO commands with elevated privileges, permitting unauthorized creation or modification of files and thereby escalating authority on the host system.

All Linux kernel releases that include the ksmbd component, particularly those exposing SMB2 services to external networks, are potentially vulnerable until the credential‑handling fix is applied. No specific version range is noted, so any kernel build containing ksmbd before the patch is considered affected.

The CVSS score of 9.1 indicates a critical severity. The EPSS score is less than 1%, suggesting a currently low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need network access to a remote SMB2 service to issue SET_INFO requests; if successful, the attacker could gain privileges beyond those assigned to the SMB connection, creating a substantial security risk. The vulnerability involves improper credential handling (CWE-270).