The vulnerability originates in the Linux kernel’s ksmbd subsystem, where the preauthentication buffer (conn->preauth_info) is freed during an SMB2 NEGOTIATE failure while another thread may concurrently read it. The send path for the SMB3 PREAUTH HASH response does not hold the connection lock, creating a race that allows a use‑after‑free read, as confirmed by KASAN. An attacker who can initiate two concurrent NEGOTIATE requests on the same SMB connection can trigger this race, potentially reading freed kernel memory or corrupting it, which could lead to arbitrary code execution with kernel privileges.

All Linux Kernel releases that include the ksmbd module and lack the fix commit 0c054227 or later. Distributions shipping a default kernel with ksmbd active are impacted unless the kernel has been backported with the resolution. External vendors should verify that their kernel images contain the commit before exposing the SMB service over port 445.

The EPSS score is reported as < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation to date. The flaw can be triggered remotely via the SMB protocol, and with a CVSS score of 9.8 it signifies a critical severity that reflects the potential for kernel memory corruption and remote code execution if the race condition is exploited. The risk is considered theoretical but significant, especially for systems that expose ksmbd to untrusted networks.