In the Linux kernel's SMB daemon, ksmbd, the listener thread terminates when its socket is closed. The network device notifier shuts down that socket before calling kthread_stop, causing the thread's task_struct to be freed while the thread is still running. This race condition results in a use‑after‑free that can corrupt kernel memory, potentially enabling a local attacker to gain elevated privileges or crash the system.

All Linux kernel releases that contain the ksmbd implementation and have not applied the published fix are affected. The advisory lists no specific kernel version ranges, so any kernel that includes ksmbd prior to the patch should be treated as vulnerable.

The CVSS score is not provided, and EPSS data is unavailable, indicating that exploitation probability has not been quantified. The vulnerability is not included in the CISA KEV catalog. Exploitation would likely require an attacker with local access to trigger a netdevice event that could create the race condition; based on the description, it is inferred that an attacker could manipulate interface enable/disable or TCP teardown events while ksmbd is active. Because the flaw affects kernel memory, the impact is high, with the potential for privilege escalation or denial of service.