A use‑after‑free flaw in the ksmbd SMB server module causes the function same_client_has_lease() to return a pointer to a lease structure after releasing a lock and without taking a reference. When a client concurrently closes, the lease can be freed while another function dereferences the stale pointer, corrupting kernel memory. This flaw can allow an attacker to trigger arbitrary kernel memory corruption, potentially leading to privilege escalation or complete system takeover. The weakness maps to CWE‑416: Use‑After‑Free.

The vulnerability exists in the Linux kernel, affecting all distributions that ship the vfs or ksmbd code unchanged. No specific Linux kernel version range is listed in the advisory.

The advisory does not provide an EPSS score or CVSS score, but the nature of a kernel use‑after‑free strongly suggests a high exploitability. The vulnerability can be triggered by a client that establishes an SMB lease and performs an out‑of‑order close on the same connection, implying a remote attack vector from an SMB client. Because the flaw is in kernel code, a successful exploit would grant the attacker root privileges. The advisory states the vulnerability is not listed in CISA KEV; however, the potential impact warrants immediate action.