ksmbd, the SMB server component in the Linux kernel, incorrectly handles concurrent SMB2 QUERY_DIRECTORY requests that share the same file handle. During directory enumeration, a stack‑allocated private structure pointer is stored in a shared field; a second concurrent request can overwrite this pointer while the first request is still using it, causing a stack use‑after‑free. This flaw is a CWE‑416 Use‑After‑Free and can corrupt kernel memory; based on the description, an attacker might trigger a kernel crash or, in a suitable environment, execute code with kernel privileges.

All Linux kernels that include the ksmbd module and have not incorporated the per‑file mutex patch are affected. The advisory does not list specific release numbers, so any kernel built with ksmbd prior to the patch is at risk. Distributions that ship an unpatched kernel, custom kernels that embed ksmbd without the fix, or environments exposing SMB shares via ksmbd are therefore impacted.

The CVSS score of 9.8 marks this as a high‑severity flaw; however, the EPSS score is below 1% and it has not yet been listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The race condition requires an attacker who can send concurrent directory listing requests over SMB to the same file handle. While there is no published exploit, the kernel memory corruption could lead to a denial of service or, if an exploit is crafted, remote code execution, so the vulnerability warrants prompt mitigation.