The Linux kernel ksmbd subsystem contains a use‑after‑free bug that triggers when an authenticated SMB client closes a locking handle with SMB2_CLOSE and subsequently cancels the same operation with SMB2_CANCEL. The bug causes the kernel to free the underlying file_lock while a deferred work item still holds a reference to it, and the cancel function is later invoked on the freed memory. This reuse of freed memory can corrupt kernel data structures and provides an attacker with a foothold to execute arbitrary code at ring‑0.

All Linux kernel builds that do not include commit f580d27e8928 (the ksmbd fix) are vulnerable when the ksmbd service is enabled and reachable by an authenticated SMB client. The vulnerability exists in all released kernel versions preceding mainline 7.1‑rc7; any system running an older kernel with ksmbd processes is at risk, while newer kernels that incorporate the commit are considered fixed.

The CVSS score of 8.8 denotes high severity, yet the EPSS score of < 1 % indicates a currently low probability of exploitation, and the flaw is not listed in the CISA KEV catalogue. Exploitation requires a remote authenticated SMB session, meaning the attacker must obtain valid credentials or otherwise authenticate to the ksmbd service. In a scenario where ksmbd is exposed to untrusted networks, an attacker could gain kernel privileges, potentially compromising the entire host. The attack vector is remote and relies solely on SMB communication, so restricting or disabling the service mitigates the risk.