A use-after-free flaw within the Linux kernel ksmbd module could allow a remote authenticated attacker to compromise system integrity or cause a denial of service.

The vulnerability stems from improper reference counting in the ksmbd_file structure, which may remain active after a logical close while another session holds a reference. This allows for a use-after-free condition, requiring the attacker to have authenticated access to the network share.

This vulnerability poses a significant risk to file servers running the ksmbd module. An attacker could potentially achieve remote code execution or crash the server, resulting in data loss or disruption of critical business operations. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, or later.

Proactive Monitoring: Monitor SMB traffic logs for unusual session activity or repeated connection resets that might indicate an attempt to trigger the race condition.

Compensating Controls: If patching is delayed, disable the ksmbd kernel module if it is not strictly required for business operations.

Public Exploit Available: Unknown.

System administrators should immediately identify and update all servers utilizing the ksmbd module. Due to the high severity and the potential for remote exploitation, patching should be completed as part of the next available maintenance cycle to minimize the window of exposure.