The vulnerability in the Linux kernel ksmbd module concerns the handling of durable reconnect error paths. After a durable reconnect succeeds, the same ksmbd_file is republished in the session volatile-id table. If an error occurs later in smb2_open(), cleanup calls ksmbd_fd_put() and then unconditionally calls ksmbd_put_durable_fd() on the same file object. The final close operation is not session-aware and may free the file object without removing its volatile-id entry, leading to a potential use-after-free or stale reference. Earlier reconnect failures do not exhibit this issue as they use a different cleanup path. This flaw could allow attackers to affect system confidentiality, integrity, and availability.

Successful exploitation could lead to use-after-free conditions in the ksmbd file handling, potentially causing system instability, crashes, or unauthorized access to kernel memory. The CVSS 3.1 score of 9.8 reflects critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not confirmed from the provided information. Users should monitor official Linux kernel advisories and apply updates when available to address this vulnerability. Since this is a kernel-level issue, updating to a fixed kernel version is the recommended remediation once released.