The ksmbd component of the Linux kernel mismanages concurrent SMB2 QUERY_DIRECTORY requests that share the same file handle. While processing a directory read, a pointer to a stack‑allocated private structure is stored in a shared field. If a second request arrives and overwrites this pointer before the first request finishes, the kernel accesses freed stack memory, causing a stack use‑after‑free race condition. A successful exploit could corrupt kernel memory, leading to denial of service or, in configurations where attacker control can be achieved, arbitrary code execution.

All Linux kernel installations that ship ksmbd without the recent per‑file mutex fix are affected. Because the advisory does not list specific releases, any distribution that has not applied the latest kernel update containing the patch, as well as custom kernel builds that incorporate an unpatched ksmbd, remain at risk. The vulnerability is relevant to systems running SMB shares via ksmbd.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, which together suggest a low probability of public exploitation at present. Based on the description, it is inferred that an attacker who can gain SMB access and orchestrate concurrent QUERY_DIRECTORY requests on the same file handle could trigger the race condition and potentially cause a kernel crash or write to memory. This inference follows from the race description but is not confirmed by an existing exploit. Additionally, it is inferred that a highly skilled adversary might attempt to time overlapping requests to manipulate the shared pointer, although such an attack remains speculative.