The vulnerability in the Linux kernel's ksmbd SMB server implementation arises from the premature publication of granted locks to connection-wide and file-wide lock lists immediately after individual lock grants succeed within a batch. If a later lock in the batch fails validation, the granting thread rolls back previously granted locks by dereferencing and freeing them from a rollback list. However, because these locks were already published, a concurrent unlock request could free them first, leading to a use-after-free and double-free condition. The fix defers publishing granted locks to the shared lists until the entire batch is successfully processed, eliminating the race window.

Successful exploitation can lead to use-after-free and double-free conditions in kernel memory, potentially causing system crashes, denial of service, or arbitrary code execution with kernel privileges. The CVSS score of 8.8 indicates high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

A fix is available that defers the publication of granted locks until the entire batch of lock requests is processed without error, preventing the race condition. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability.