A memory leak occurs when the ksmbd component attempts to set a security descriptor attribute. The encoding routine allocates a buffer, but if an error occurs during subsequent writes, the buffer is not freed. Over time, repeated failures could consume extensive memory, potentially leading to system instability or crash. The vulnerability is a classic memory-leak flaw that compromises integrity and availability, not confidentiality.

The flaw exists in the Linux kernel, affecting all distributions that ship the default ksmbd implementation. No specific vendor or distribution information is provided, and version details are not supplied in the advisory, so any system running an unpatched kernel may be vulnerable.

Because the CVSS score is not disclosed and the EPSS value is unavailable, the precise severity and exploitation likelihood are unknown. However, the flaw is exploitable via SMB traffic that triggers the security descriptor attribute handling. The lack of a KEV listing suggests no known widespread exploitation, but the memory leak can still be abused by an attacker controlling SMB requests to cause a denial of service. The likely attack vector is network-based SMB traffic; this inference is drawn from the fact that ksmbd handles SMB operations.