Technical impact
The ksmbd SMB daemon in the Linux kernel uses a listener thread that terminates when its listening socket is shut down. The netdevice notifier pre‑emptively shuts down this socket before the thread obtains a reference for kthread_stop(), causing the listener’s task_struct to be freed while the thread is still running. This race condition produces a use‑after‑free that can corrupt kernel memory. The resulting memory corruption enables a local attacker to corrupt kernel data, potentially gain elevated privileges or crash the system. Based on the description, it is inferred that the compromise can be triggered by a local user who can generate netdevice events such as enabling or disabling interfaces or performing a TCP teardown while ksmbd is active.
Affected Systems
All Linux kernel releases that include the ksmbd implementation before the published fix are affected. The CNA list lists Linux without specifying a version range, so any kernel containing ksmbd prior to the patch should be treated as vulnerable.
Risk and Exploitability
The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% shows a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires local access to trigger a netdevice event—such as enabling or disabling a network interface or initiating TCP teardown—while ksmbd is active. If successful, the resulting memory corruption could lead to privilege escalation or service disruption.
Ubuntu USN