A critical use-after-free vulnerability in the Linux kernel ksmbd component poses a severe risk of remote code execution and system instability.

The ksmbd implementation suffers from a race condition during tree connection handling, where a concurrent session logoff can free a tree connection object while it is still in use by the smb2_tree_connect handler. This flaw is reachable by unauthenticated remote attackers, as indicated by the CVSS attack vector (AV:N/PR:N).

The vulnerability carries a CVSS score of 9.8, reflecting its potential for full system compromise. Successful exploitation allows an attacker to trigger memory corruption, which typically leads to arbitrary code execution or a complete denial of service. Such an outcome could result in significant operational downtime and the unauthorized exposure of sensitive data stored on or processed by the affected server.

Immediate Action: Update the Linux kernel to version 7.2.6 or apply the upstream patches provided by the kernel maintainers to address the reference counting imbalance.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults related to ksmbd, or unusual network traffic patterns targeting SMB services.

Compensating Controls: If patching is not immediately feasible, disable the ksmbd service on exposed interfaces or implement network-level access controls to restrict access to the SMB server to trusted internal segments.

Public Exploit Available: Unknown

Given the critical severity and the potential for unauthenticated remote exploitation, organizations running ksmbd should treat this as a high-priority update. Administrators must verify their kernel versions and apply the necessary patches immediately to eliminate the risk of memory-based exploitation.