This flaw occurs in the ksmbd SMB daemon of the Linux kernel, where certain FSCTL commands that modify file attributes—such as SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION—are executed with the credentials of the kernel worker thread rather than the credentials of the client that opened the file. Because the helper functions perform inode permission checks using those worker credentials, an attacker can perform metadata or content modifications on files to which they normally would not have access, thereby violating the intended access controls and potentially corrupting data or leaking sensitive information.

All installations of the Linux kernel that include the ksmbd component and have not applied the upstream patch commit 1e112c47 (or any subsequent commits that fixed the issue) are affected. This encompasses every Linux distribution that ships a ksmbd daemon in the kernel at any point before the patch, regardless of vendor or version detachment.

The vulnerability can be exercised by an attacker who can send the relevant FSCTL commands through an SMB session to the ksmbd service. The requirement for only standard SMB FSCTL operations makes the remote exploitation path plausible, although the original description does not explicitly state that the attack is network‑based; this inference is based on the fact that ksmbd mediates SMB client requests over the network. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the absence of these metrics does not diminish the high impact of enabling elevated kernel‑level operations. The CVSS score of 9.1 underscores the critical severity of this issue. Consequently, the risk of a successful exploitation remains high if unmitigated.