A critical use-after-free flaw in the Linux ksmbd module allows an authenticated SMB client to trigger memory corruption and potential code execution.

The vulnerability is a use-after-free flaw in the ksmbd server implementation. An authenticated attacker can trigger the vulnerability by sending a specific sequence of SMB2_CLOSE and SMB2_CANCEL commands, leading to the reuse of a freed file_lock object.

With a CVSS score of 8.8, this vulnerability poses a severe threat to organizations utilizing ksmbd for file sharing. Successful exploitation could allow an attacker to gain unauthorized access to data, modify files, or execute arbitrary code with kernel-level privileges, leading to a total compromise of the affected server.

Immediate Action: Update the Linux kernel to the patched versions 6.1.178, 6.6.145, 6.12.96, or 6.18.39 immediately.

Proactive Monitoring: Review SMB server traffic logs for unusual command sequences or repeated connection drops that might indicate an exploitation attempt.

Compensating Controls: If patching is delayed, disable the ksmbd service or restrict SMB access to trusted network segments to reduce the attack surface.

Public Exploit Available: Unknown

Due to the severity of this vulnerability and its potential for remote code execution, immediate patching is required. Organizations should treat this as a high-priority update to protect their file storage infrastructure.