A race condition between two concurrent SMB2 durable reconnect operations in the Linux kernel’s ksmbd module causes the kernel to compare the fp->owner.name string while another thread frees the same memory. This use-after-free can corrupt kernel memory or lead to a crash. The description does not state explicit code execution, but such corruption in kernel space generally exposes the potential for privilege escalation or denial of service if an attacker can trigger the race.

All Linux kernel builds that incorporate the ksmbd SMB server module and omit the commit that serializes the fp->owner.name access (7ce4fc40018d) are affected. The advisory does not list specific kernel versions; thus, any kernel predating the inclusion of this patch is potentially vulnerable.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not in CISA’s KEV catalog. Successful exploitation would require an attacker with SMB connectivity capable of inducing a precise race between durable reconnect operations, which increases the technical barrier to a practical attack.