The vulnerability stems from ksmbd failing to reclaim session resources after a client logs off or a session expires. Sessions that are marked as Expired but have zero credential expiry remain in the kernel’s global table, holding memory and connection slots until an expiration worker processes them. An attacker can induce many such abandoned sessions— by repeatedly creating and logging off SMB connections— to exhaust kernel memory or SMB session slots, thereby disrupting the SMB service and potentially other kernel components. This defect is effectively a resource leak that can lead to denial of service.

All Linux environments running a kernel version that does not yet incorporate the ksmbd session cleanup fix are impacted. The flaw is confined to the kernel’s SMB server implementation and therefore affects any host that exposes SMB sessions. It does not require any particular distribution; any Linux kernel that includes ksmbd without the recent patch is vulnerable.

The CVSS score or EPSS is not available, but the weakness can be exploited remotely against the SMB service without the need for privilege escalation. An attacker can force repeated logoff and session creation to consume resources, which may result in a denial‑of‑service condition. The flaw is not listed in the CISA KEV catalog, yet due to its potential to exhaust kernel resources the risk should be treated as high. The lack of immediate recovery means that exploitation would simply stall the kernel’s ability to accept new SMB sessions until the kernel’s thread scheduler recovers from the resource pressure.