The vulnerability in the Linux kernel ksmbd subsystem involves a use-after-free in the oplock break notification function smb2_oplock_break_noti(). The function reads opinfo->conn without locking and dereferences it after allocations that may sleep. When the durable handle owning the oplock disconnects, session_fd_check() clears opinfo->conn and drops its reference under a lock, potentially freeing the connection. A concurrent oplock break triggered by another connection can race with this teardown, causing ksmbd_conn_get() to increment a reference count on a freed connection. Later, the stale connection is dereferenced in ksmbd_conn_write(), leading to use-after-free. The patch threads the caller's inode through the notification path to ensure the connection cannot be freed during the call, uses proper locking (ci->m_lock) to select and pin the connection, and transfers the reference to the work item to avoid premature freeing.

The vulnerability allows an authenticated client holding a durable batch oplock to trigger a use-after-free condition in the ksmbd kernel module. This could lead to kernel memory corruption, potentially causing system instability or escalation of privileges. However, exploitation requires authentication and specific conditions involving oplock breaks and durable handles.

A fix has been implemented in the Linux kernel ksmbd component to address this use-after-free vulnerability. Users and administrators should apply the official kernel updates that include this patch once available. No additional mitigation is required beyond applying the official fix.