The Linux kernel’s ksmbd implementation incorrectly removes stale channel references only when a connection’s binding flag is set. After a channel is bound to another session and the flag is cleared, the channel remains in the owning session’s list. When that session subsequently tears down, the kernel dereferences the freed channel structure, resulting in a use‑after‑free write. This memory corruption vulnerability may allow an attacker to execute arbitrary code or cause a denial of service (inference). The flaw is a classic use‑after‑free weakness.

All Linux kernel deployments that provide the ksmbd SMB service are affected. No specific kernel version identifiers are listed in the advisory, so the vulnerability may exist in any kernel revision that contains the legacy ksmbd channel‑cleanup logic.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been observed in the wild. The CVSS score of 8.8 reflects a high severity rating for this use‑after‑free bug. Exploitation would require an attacker able to establish one or more authenticated SMB sessions, which can be achieved remotely from any machine that can reach the ksmbd service (inference). The attack surface is therefore significant for systems exposing SMB and likely requires kernel privilege escalation to fully exploit the memory corruption (inference).