The kernel’s ksmbd service performs path resolution for create, mkdir, and hardlink operations without the LOOKUP_BENEATH restriction that protects read lookups. The function ksmbd_vfs_kern_path_create builds an absolute path with convert_to_unix_name() and walks it from AT_FDCWD, which lets an authenticated SMB client include a '..' component that is resolved relative to the real filesystem root. When a race occurs while a missing component causes the lookup to fail, the subsequent create walk can escape the share and access any file on the host. This flaw is a classic directory traversal (CWE‑22) that permits reading or modifying files outside the intended share, provided the attacker has valid SMB credentials and can reach the SMB service.

Linux kernels that lack the patch identified by commit 1c8951963d8ed357f70f59e0ad4ddce2199d2016. The affected product is the Linux kernel shipped by Linux:Linux, with no specific version range supplied; any kernel built before this commit is vulnerable.

The CVSS score of 9.1 reflects a high severity impact, while the EPSS score of < 1% indicates that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network connectivity to the SMB port (typically TCP 445), valid SMB credentials, and a race condition where the create path resolves a '..' component after the lookup has failed. Once achieved, the attacker gains unauthorized access to arbitrary files on the host, which could lead to privilege escalation or data theft.