A critical stack use-after-free vulnerability in the Linux kernel ksmbd module allows unauthenticated remote attackers to potentially achieve arbitrary code execution or cause system crashes.

The smb2_query_dir function fails to properly serialize QUERY_DIRECTORY requests, leading to a race condition where concurrent requests overwrite a stack-allocated pointer. This results in a use-after-free condition that can be triggered by unauthenticated network users.

This vulnerability carries a CVSS score of 9.8, reflecting its potential for full system compromise. Successful exploitation allows remote attackers to execute arbitrary code with kernel-level privileges, leading to complete data exfiltration, total loss of system integrity, and significant operational downtime.

Immediate Action: Update the Linux kernel to version 6.1.178, 6.6.145, 6.12.96, 6.18.39, or newer depending on your distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected crashes associated with the ksmbd module and investigate network traffic for unusual SMB query patterns.

Compensating Controls: If patching is delayed, disable the ksmbd kernel module if it is not required for business operations, or restrict SMB traffic at the network perimeter to trusted internal segments.

Public Exploit Available: Unknown.

The severity of this flaw cannot be overstated given the potential for kernel-level execution. Administrators must prioritize updating affected Linux kernels to the identified patched versions immediately to eliminate the exposure window. Ensure that kernel update workflows are tested and deployed across all production environments to mitigate the risk of remote compromise.