The vulnerability in the Linux kernel ksmbd subsystem concerns improper tracking and removal of byte-range locks when SMB3 multichannel is used. SMB2_LOCK adds locks to both the file and connection lock lists, but the removal process can occur under different spinlocks due to multichannel connections differing from the original file opener connection. This mismatch can cause concurrent traversals to access freed ksmbd_lock and file_lock structures, leading to potential use-after-free conditions. The resolution involves recording the owning connection for each lock entry and maintaining a reference to it while linked, using the correct connection and its lock for all lock removal and preservation operations, and updating the connection owner during durable reconnects.

The vulnerability could allow concurrent access to freed kernel memory structures related to SMB byte-range locks, potentially leading to kernel memory corruption or instability. No known exploits in the wild have been reported. The impact is limited to systems using the ksmbd SMB server component with SMB3 multichannel enabled.

A fix has been implemented in the Linux kernel to properly track and manage the connection owning each byte-range lock in ksmbd. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly stated here; check the vendor or kernel mailing lists for the specific fixed kernel version.