The vulnerability in the Linux kernel ksmbd subsystem involves the function ksmbd_reopen_durable_fd() which improperly rebinds every detached oplock on an inode to the reconnecting session without verifying ownership. This causes oplocks from other sessions to be adopted incorrectly, leading to stale session pointers after session destruction. The stale pointers are dereferenced later, causing a kernel use-after-free bug detected by KASAN. The issue arises when two sessions open the same file with durable-v2 handles and RH leases under distinct AppInstanceIds, both disconnect, and one reconnects, resulting in a freed session being accessed. The fix constrains the rebind loop to only the oplock owned by the file being reopened.

This vulnerability can cause a kernel use-after-free condition, potentially leading to kernel crashes or memory corruption. It affects authenticated users accessing shares with default durable-handle and oplock configurations. There is no evidence of known exploits in the wild. The impact is limited to kernel stability and security in scenarios involving multiple durable handle sessions on the same file.

A fix has been implemented in the Linux kernel to constrain oplock rebinding to only the file being reopened, preventing stale session references. Users should update to the patched kernel version once available. No additional mitigations are specified or required beyond applying the official fix.