A critical use-after-free vulnerability in the Linux kernel ksmbd module exposes systems to potential remote code execution and denial of service due to improper connection handling.

The vulnerability exists within the ksmbd module, specifically regarding how async oplock and lease break notifications handle connection object lifetimes. An unauthenticated attacker can trigger a race condition during connection teardown, causing the kernel to access a freed connection object, which leads to memory corruption.

Successful exploitation of this vulnerability allows an attacker to compromise the integrity, availability, and confidentiality of the host system. With a CVSS score of 9.8, this flaw is considered critical because it permits unauthenticated remote code execution, which could lead to full system takeover, unauthorized data access, or persistent denial of service that disrupts business-critical operations.

Immediate Action: Update the Linux kernel to version 6.6.148, 6.12.101, 6.18.42, or 7.1.6, depending on the distribution branch in use.

Proactive Monitoring: Monitor system logs for kernel panics or repeated segmentation faults specifically involving the ksmbd module, which may indicate attempted exploitation.

Compensating Controls: If immediate patching is not possible, disable the ksmbd kernel module if it is not required for business operations, or restrict access to SMB ports (typically 445) at the network perimeter to trusted internal segments only.

Public Exploit Available: Unknown

Given the critical severity and the potential for remote exploitation without authentication, immediate remediation is required. Administrators should prioritize identifying kernel versions currently running the ksmbd module and apply the provided security updates to all affected Linux environments as part of the next maintenance cycle.