The ksmbd oplocks whose connection pointer is null when a durable handle is reopened. This action creates a stale reference to a destroyed session inside the oplock. Later, when the file is closed, the stale reference is dereferenced, leading to a kernel Address‑Space Exposure and a BUG that can cause a kernel panic. The flaw is a classic use‑after‑free condition and an improper reference handling problem.

All systems running the Linux kernel that ship the ksmbd SMB server and have the default durable‑handle and oplock configuration enabled. Any distribution that allows multiple authenticated SMB sessions to open the same file with durable handles is affected; no specific kernel or distribution version is listed in the advisory.

The CVSS base score of 9.8 indicates critical severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to establish one or more authenticated SMB sessions on a share that permits durable handles, open the same file from distinct AppInstanceIds, then orchestrate a disconnect‑reconnect sequence so that a stale oplock reference is created and later dereferenced. If successfully triggered, a local or remote attacker could cause a kernel panic. The extremely low EPSS and the requirement for specific session activities suggest the risk remains low in typical scenarios, however the potential for a kernel crash warrants immediate patching.