In the Linux kernel's SMB server component, ksmbd, a race condition arises during concurrent SMB2 durable reconnects. The kernel uses a standalone string buffer, fp->owner.name, which is independently freed during a successful reconnect. When two processes perform a durable reconnect simultaneously, one compares this string while the other frees it, resulting in a use‑after‑free inside strcmp. This flaw allows the attacker to execute arbitrary code in kernel context, effectively granting them unrestricted privileges on the system.

The vulnerability exists in any Linux kernel implementation that includes the ksmbd module prior to the patch that serializes access with fp->f_lock. The specific kernel version is not listed in the advisory, so all older builds lacking the patch are potentially affected. Users running an up‑to‑date kernel that incorporates the commit mentioned in the description are not vulnerable.

No CVSS score is provided and the EPSS value is unavailable, but the nature of the flaw—an unsanitized kernel use‑after‑free—normally translates to a high severity rating. Because the attack requires a timing corner between two SMB reconnections, exploitation may be non‑obvious, but a determined adversary could engineer the race. The vulnerability is not yet listed in CISA’s KEV catalog, but it should be treated as high risk until a patch is deployed.