In the Linux kernel’s ksmbd module, a bug in the handling of session tear‑down when using SMB3 multichannel was identified and fixed. The patch ensures that all channels bound to a session are fully drained before freeing shared session objects and that deferred byte‑range locks are awakened and cleaned up correctly during a drain. This prevents races or dangling references that could otherwise leave the kernel in an inconsistent state, potentially causing resource leakage or service disruption.

Linux kernel. All kernel releases that include the ksmbd module and support SMB3 multichannel without the patch remain affected. Because specific affected versions are not listed, any kernel build pre‑dating the commit that introduced the session‑drain logic should be considered vulnerable.

The CVSS score of 8.8 indicates high severity while the EPSS score of < 1 % suggests a low exploitation probability. The CVE is not listed in the CISA KEV catalog, so no public exploits are known. The likely attack vector is a remote SMB client sending LOGOFF, CANCEL, or other session‑teardown operations that may trigger the race condition. Successful exploitation would require the target to be exposed to SMB traffic and the attacker to have the ability to send SMB requests.