The Linux kernel’s ksmbd service contains a lock ordering flaw that can cause its expiration worker to deadlock. When the worker attempts to read the shared conn_list_lock while also acquiring session locks that are already held by other operations, a circular wait can arise. The worker may block until a writer on conn_list_lock releases it, but that writer cannot proceed until the worker releases its lock after the session lock is released. This lock contention can freeze the periodic worker thread, causing SMB connections to stall and potentially leading to a persistent denial of service for the ksmbd service.

All Linux kernel builds that include the ksmbd implementation and have not yet applied the patch commit 4e4e8b38994a0b0fc23f00ca6698b469a41abe70 are affected. The issue applies to any kernel version that contains the unpatched ksmbd code, as no specific version list is supplied.

The CVSS and EPSS scores are not publicly available, and the vulnerability is not listed in CISA KEV, so the documented exploitation probability is unknown. Based on the code behavior described, an attacker could trigger the lock contention by opening many SMB connections, thus the likely attack vector is through the SMB protocol to the affected system. This inference is made from the description, which does not directly state the attack method. The flaw resides entirely in kernel space and does not provide privilege escalation or confidentiality compromise, but it can impair the availability of the ksmbd service, especially under high load or default configuration.