The vulnerability in the Linux kernel's ksmbd subsystem involves a use-after-free condition of the struct file_lock during SMB2_LOCK deferred-lock cancellation. When a blocking byte-range lock request is deferred, ksmbd registers asynchronous work. If the lock waiter wakes but the work state is no longer active, the cleanup frees the lock without dequeuing the async work. Concurrent cancellation can then dereference the freed lock, causing a slab-use-after-free inside __wake_up_common. The patch moves list removal and async work release to the start of cleanup to prevent concurrent access to freed memory.

This use-after-free vulnerability can lead to kernel memory corruption, potentially causing system instability or crashes. While no known exploits are reported in the wild, successful exploitation could affect system reliability and security by corrupting kernel memory structures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by restructuring the cleanup logic in ksmbd. Users and administrators should monitor official Linux kernel advisories and apply updates when available to mitigate this issue.