The Linux kernel contains a use‑after‑free flaw in the ksmbd SMB daemon. When an oplock or lease break notification is processed asynchronously, the worker retains a ksmbd_conn pointer but does not pin the reference. If the connection is torn down at the same time, the last reference may be released before the worker finishes. The worker then uses the freed object in write and reference‑decrement operations, corrupting kernel memory. Based on the description, it is inferred that this race could result in unintended kernel behavior, which might lead to privilege escalation, but no explicit exploit method is documented.

All Linux distributions that ship the Linux kernel with the ksmbd SMB server component are potentially affected. No specific kernel version is listed, so systems running any kernel that includes ksmbd are at risk until the upstream patch is applied.

The flaw has a CVSS score of 9.8, indicating high severity. The EPSS score of < 1% reflects a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote SMB access, inferred because ksmbd is an SMB server; however, the CVE entry does not provide a documented exploitation path.