The ksmbd module incorrectly rebinds all detached oplocks whose connection pointer is null when a durable handle is reopened. This action creates a stale reference to a destroyed session inside the oplock. Later, when the file is closed, the stale reference is dereferenced, leading to a kernel Address‑Space Exposure and a BUG that can cause a kernel panic. The flaw is a classic use‑after‑free condition and an improper reference handling problem.

All systems running the Linux kernel that ship the ksmbd SMB server and have the default durable‑handle and oplock configuration enabled. Any distribution that allows multiple authenticated SMB sessions to open the same file with durable handles is affected; no specific kernel or distribution version is listed in the advisory.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to establish one or more authenticated SMB sessions on a share that permits durable handles, open the same file from distinct AppInstanceIds, then orchestrate a disconnect‑reconnect sequence so that a stale oplock reference is created and later dereferenced. If successfully triggered, a local or remote attacker could cause a kernel panic or obtain elevated privileges. The low EPSS and the need for specific session activities suggest a moderate risk in typical scenarios, but the potential for a kernel crash or privilege escalation warrants timely patching.