The ksmbd implementation contains a flaw that allows session objects to be freed while still referenced by active SMB3 multichannel connections, causing a use‑after‑free that can crash the kernel or lead to resource exhaustion. Deferred byte‑range locks remain counted as running requests until their files close, delaying cleanup. An attacker could exploit this by repeatedly issuing LOGOFF or CANCEL operations to destabilize the server.

All Linux kernels that include the ksmbd subsystem and have not applied the recent patch. The advisory does not enumerate exact versions, so any unpatched kernel that supports SMB3 and multichannel is potentially vulnerable. The fix is distributed with newer kernel releases, but affected kernels are those running before the patch commit.

No EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits are known. The likely attack vector is a remote SMB client that initiates LOGOFF, CANCEL, or connection teardown while the server is servicing locks; successful exploitation requires the server to be exposed to SMB traffic. Because the impact can materialize as a kernel crash or prolonged resource starvation, unpatched systems face high‑severity risk if SMB traffic is not controlled.