The vulnerability involves a use‑after‑free condition in the Linux kernel’s ksmbd implementation. During a session close, a ksmbd_file can survive a logical close while another session keeps a temporary reference. The closing session drops its idr reference but leaves the pointer in the closing session’s idr until the final reference is released. When that final put occurs, the object is freed without removing it from the owner’s idr, producing a stale pointer that the owner later dereferences during file‑table teardown. This flaw can corrupt kernel memory and, if exploited, potentially allow an attacker to execute arbitrary code with kernel privileges.

All Linux kernel distributions are affected; the vendor list is Linux and the product is the Linux kernel. No specific version information is provided, so any kernel build that contains ksmbd before the fix is potentially vulnerable.

The control flow of the flaw is tied to SMB sessions managed by ksmbd. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.8 rates the flaw as high severity, reflecting significant potential impact. Nevertheless, the use‑after‑free condition could be leveraged by an attacker who can trigger the problematic file‑table teardown sequence, potentially leading to privilege escalation. The attack would likely require participation in an SMB session with sufficient privileges to interact with ksmbd.