This vulnerability arises in the Linux kernel’s SMB daemon (ksmbd). The server incorrectly counts only in‑progress sessions toward the per‑connection limit, allowing a client to authenticate repeatedly and accumulate an unrestricted number of valid sessions on a single connection. This flaw enables resource exhaustion and potential denial‑of‑service on the host, as an attacker could deplete memory or other kernel resources by creating a large number of orphaned session objects that remain allocated until the connection is terminated. The resolution implements a reservation mechanism and enforces a maximum session count per connection, defaulting to 64 when unspecified.

The flaw affects any Linux system running a kernel that includes ksmbd without the patch. The impacted products are versions of the Linux kernel up to the point where this commit was integrated. All kernel builds are potentially affected until the fix is applied; no specific kernel release is listed beyond "cpe:2.3:o:linux:linux_kernel:*".

No CVSS score is provided, and the EPSS score is not available, indicating no publicly documented exploitation data at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be remote, via an SMB client that can repeatedly authenticate and keep sessions alive. An attacker only needs the ability to establish SMB connections to the target host; no privileged access is required. Successful exploitation would degrade service availability, potentially leading to a denial‑of‑service condition for legitimate users.