The Linux kernel's ksmbd module had a vulnerability where delete-on-close operations, which can be completed during deferred or durable handle teardown without active request work, executed with ksmbd worker credentials. This caused both base-file unlink and ADS xattr removal to bypass filesystem permission checks. The fix involves running these operations with the credentials stored in the file handle at open time, maintaining the authenticated user's fsuid, fsgid, supplementary groups, and capability restrictions during final close.

An attacker able to trigger delete-on-close operations could bypass filesystem permission checks, potentially deleting files or removing extended attributes without proper authorization. This undermines filesystem security and could lead to unauthorized data modification or loss.

A fix has been implemented in the Linux kernel to address this vulnerability by using the opener's credentials for delete-on-close operations. Users should apply the official kernel updates that include this patch to remediate the issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.