This vulnerability is a use‑after‑free within the ksmbd SMB server of the Linux kernel, classified as CWE‑825. When an authenticated SMB client performs an SMB2_CLOSE on a locking handle, the ksmbd work queue transitions the deferred lock to a CLOSED state and frees the underlying file_lock without executing its cleanup routine. A following SMB2_CANCEL for the same AsyncId then invokes the already‑freed cancel function, leading to a use‑after‑free that corrupts kernel memory. The resulting memory corruption could enable the attacker to execute arbitrary code in kernel mode or crash the system. The flaw is triggered by remote SMB interaction and requires the client to be authenticated, which limits initial access to systems that expose ksmbd to trusted clients.

All Linux kernel builds that lack the fix introduced in commit f580d27e8928 are vulnerable when ksmbd is enabled and reachable from an authenticated client. The patch is present in mainline kernel 7.1‑rc7 and later releases. Therefore any machine running an earlier kernel version (for example, 5.x or 6.x series up to 7.0‑rcX) is susceptible as long as the ksmbd service is active. The vulnerability is specific to the ksmbd component of the Linux kernel; other kernel subsystems are not affected.

The CVSS score for this flaw is 8.8, indicating high severity. The EPSS score is reported as < 1 %, showing a very low current exploitation likelihood, and the vulnerability has not been listed in CISA’s KEV catalogue. Exploitation, however, requires a remote authenticated SMB session, making it a privileged remote code execution vector. In environments where ksmbd is exposed to untrusted networks, an attacker could gain kernel‑level privileges, potentially compromising the entire host. The attack vector is remote and relies on network‑based SMB communication, so protective network controls or disabling the service can significantly reduce risk.