The ksmbd component of the Linux kernel processes SMB2/3 sessions. In this flaw, the ksmbd_session_register function incorrectly destroys a valid session after ten seconds of inactivity whenever a client initiates a new SessionSetup exchange, mistakenly conflating Session.IdleTime with Session.ExpirationTime. As a consequence, previously established tree connections are invalidated, and Windows clients see a STATUS_NETWORK_NAME_DELETED error on subsequent file-share accesses. The defect also bounds an otherwise memory‑exhaustion path, but it is inferred that a malicious attacker could deliberately generate repeated session setups to trigger denial of service. The vulnerability does not provide a remote code execution or privilege‑elevation path. This issue aligns with CWE-826.

Linux kernel, all builds that have not incorporated the ksmbd_session_register fix. The remedy is to apply kernel updates containing commits c99ea7855124ca1428a1e59c2b4590aaef34eacf and d7fd1f98607f2cd358e583f9548bdf0173090a86, which appear in the stable Linux kernel tree. No specific version numbers are listed in the advisories, so administrators should verify whether their kernel contains those commits.

The CVSS score is 5.5, indicating medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw is reachable through normal SMB traffic and can cause service disruption; it is inferred that an attacker could repeatedly initiate SessionSetup exchanges to force premature session termination. It is inferred that the attack requires no privileged credentials and is limited to denial of service of SMB services; no known active exploits exist. For environments that expose SMB shares, the risk is moderate and warrants evaluation of the potential for an attacker to interfere with session handling.