A high-severity use-after-free vulnerability in the Linux kernel ksmbd module allows authenticated attackers to trigger memory corruption and potential system instability.

This vulnerability occurs in the smb2_lock function when processing SMB2_LOCK request arrays. Due to premature publication of granted locks to global lists, an authenticated attacker can trigger a race condition that results in a use-after-free or double-free of lock structures during rollback operations.

Successful exploitation of this flaw allows a remote, authenticated attacker to crash the kernel, resulting in denial-of-service for the affected server. Given the CVSS score of 8.8, this vulnerability poses a significant risk to system availability and integrity. Because the flaw involves memory corruption, there is also a theoretical risk of arbitrary code execution, which could lead to unauthorized data access or complete system compromise.

Immediate Action: Update the Linux kernel to version 7.2.6 or later, or apply the upstream patches identified in the official Linux kernel stable git repository.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected service restarts related to the ksmbd process.

Compensating Controls: Restrict access to the SMB service to trusted users or networks to limit the pool of potential attackers who can reach the vulnerable code path.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a critical stability risk for environments utilizing the ksmbd kernel module. Administrators should prioritize patching their Linux kernels to the recommended version to eliminate the race condition. Given the potential for system-wide service disruption, testing and deployment of these updates should be scheduled as part of the next maintenance cycle.