The vulnerability in the Linux kernel's ksmbd SMB2 SET_INFO handlers stemmed from the use of current ksmbd worker credentials for owner, inode permission, and LSM checks after verifying the access mask granted to the SMB handle. This approach could allow permission checks to be bypassed or incorrectly applied. The resolution involves running the entire SET_INFO dispatch with the credentials captured at handle opening, removing separate security credential setups and unifying all SET_INFO classes under one credential scope. The fix uses direct override_creds() to properly nest with existing request credential overrides.

The vulnerability could have allowed improper permission checks during SMB2 SET_INFO operations, potentially leading to unauthorized file system modifications or information disclosure via the ksmbd service in the Linux kernel. No known exploits in the wild have been reported. The fix corrects credential handling to enforce proper access control.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to ensure proper credential handling in ksmbd SMB2 SET_INFO handlers. Since this is a kernel-level fix, updating to the patched kernel version is the recommended mitigation.