A critical vulnerability in the Linux kernel ksmbd module enables unauthenticated attackers to bypass filesystem permission checks, potentially leading to unauthorized file deletion and system instability.

The ksmbd implementation fails to properly use opener credentials during deferred or durable handle teardown, causing delete-on-close operations to execute with elevated worker credentials instead of the user's original security context. This flaw allows an unauthenticated attacker to bypass standard filesystem permission checks, resulting in unauthorized file deletion and removal of extended attributes.

Successful exploitation of this vulnerability poses a severe risk to data integrity and system availability. By bypassing permission controls, an attacker can delete critical files or modify system attributes, potentially rendering services inoperable or facilitating further system compromise. With a CVSS score of 9.1, this flaw is categorized as critical, necessitating urgent attention to prevent unauthorized destructive actions against sensitive file systems.

Immediate Action: Update the Linux kernel to versions 6.6.145, 6.12.96, 6.18.39, 7.1.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual ksmbd activity or unexpected file deletion events that do not correlate with authorized administrative actions.

Compensating Controls: If patching is delayed, consider restricting access to the ksmbd service via network firewalls or disabling the ksmbd module entirely if SMB file sharing is not required for production operations.

Public Exploit Available: No (exploit_available: false)

Given the critical severity of this vulnerability and its potential for unauthorized file system manipulation, organizations should prioritize the deployment of kernel updates across all affected environments. Administrators must ensure that the kernel is patched to the versions specified above to enforce correct credential handling and prevent permission bypass. Failure to remediate this issue promptly could lead to significant data loss or service disruption.