The ksmbd_all_conn_set_status function incorrectly treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can therefore move unrelated connections into NEED_RECONNECT or NEED_SETUP, causing unintended state changes and potentially disrupting active SMB connections. This flaw exposes the system to availability issues, as legitimate sessions may be forced to reconnect or reset without user intervention.

The vulnerability affects all Linux kernel installations that include the ksmbd subsystem; no specific kernel versions were supplied, so every kernel with ksmbd is potentially impacted until a patch is deployed.

The EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, indicating a very low likelihood of exploitation under current conditions. The likely attack vector is local or privileged access, based on the description. However, the flaw could be leveraged in scenarios with local or privileged access to force connections to fail, thereby degrading service availability. No direct remote code execution capability is reported. The absence of a publicly disclosed exploit and the low EPSS suggest that the risk is moderate if the affected service is exposed. Organizations should assume a moderate risk and plan remediation accordingly.