In the Linux kernel’s SMB server component, an authenticated user can craft an NTLM authentication blob that carries the victim’s username and a session identifier. Because the code deletes the victim’s previous session before completing NTLM validation, the victim’s session is removed while the transmission is denied, causing the victim’s SMB connection to be dropped. This is an improper ordering of authentication steps that permits a privileged operation—session termination—before establishing valid credentials, which is a privilege escalation flaw that results in a denial of service to the victim’s SMB session. The weakness maps to CWE-269, CWE-640, and CWE-408.

All Linux kernel installations that have not incorporated the fix from the recent commits described in the references are affected. Any SMB service (smbd) running these kernels can be targeted; the vulnerability is present in the default Linux kernel package regardless of vendor distribution.

Based on the description, the attack vector is inferred to be an authenticated SMB client that crafts a forged NTLM authentication blob targeting a victim’s username and session ID. The exploit requires the attacker to send this crafted blob over the SMB port, a relatively simple operation for anyone with network access. The EPSS score indicates a very low probability of exploitation (<1 %), and the vulnerability is not listed in the CISA KEV catalog. The technical path is straightforward, and the impact remains high due to forced termination of intact SMB sessions, thereby causing denial of service for the victim.