The Linux kernel’s ksmbd subsystem contains a race condition that allows a reader of a per‑session procfs entry to trigger a use‑after‑free when the session is deregistered or replaced. If the last reference held by the reader is released while the session table reference is still dropped, the reader’s callback may attempt to remove the procfs entry and block until the callback finishes, potentially leading to kernel memory corruption or a crash. The flaw originates from draining session procfs readers after dropping table references, which can leave the kernel in an inconsistent state.

All kernel releases that include a functional ksmbd component and do not contain the fix introduced in commit 1c087cf7d5386c708d8984b263280b42b3daada0 are affected. This includes any system that has the SMB/CIFS server enabled within the kernel, regardless of distribution. Users must verify whether their kernel builds incorporate the specific commit sequence that drains procfs readers before dropping references to avoid the vulnerability.

The CVSS score is not provided, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local or privileged user capable of creating, replacing, or terminating ksmbd sessions, which can trigger the use‑after‑free and cause a kernel crash; consequently, the impact is denial of service and loss of availability. Because no publicly reported exploits exist at this time, exploitation is considered low to medium, but the severity of a resulting kernel crash warrants caution.