The flaw occurs when ksmbd_session_unregister() removes a session from its global and per‑connection tables before decrementing the table reference count. While these tables are cleared, another part of the kernel may still hold a reference to the session. Because a channel only stores a raw connection pointer, the connection can be freed while it is still being accessed, for example during SMB3.1.1 binding or a procfs read. This order of operations creates a use‑after‑free condition that can corrupt memory, crash the kernel, or, if an attacker can finesse the timing, enable execution of arbitrary code. This type of vulnerability is characteristic of a use‑after‑free bug, where memory that has been freed is accessed again. Attackers that can interact with the SMB service—such as a client establishing or terminating SMB3.1.1 sessions—can potentially trigger the flaw by causing a concurrent session unregister. Because the flaw involves internal kernel data structures, exploitation would generally require privileged sandbox escalation or a kernel exploit that takes advantage of the corrupted state. Even a crash or denial of service can be harmful in a critical or high‑availability environment.

All Linux kernel implementations that contain the ksmbd SMB server component are affected. The available data does not list specific kernel versions; therefore any distribution using a ksmbd‑enabled kernel prior to the patch that introduces this reference‑holding change is potentially vulnerable. Vendors that ship their own kernel packages, such as Red Hat, Ubuntu, SUSE, and others, should verify whether the commit that resolves the issue has been rolled into their releases.

The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, so public exploitation attempts have not been reported. The CVSS score is not supplied in the data, but the nature of the bug (use‑after‑free of a core kernel data structure) suggests a severity that could range from medium to high, especially if the attacker can force the kernel to access freed memory. The likely attack vector is remote, via an SMB client that can trigger session unregister while another session holds a reference. Even if the check for exploitation was straightforward, the lack of a CVSS metric makes precise risk assessment difficult. Given the kernel context, the potential impact includes denial of service and privilege escalation.