The vulnerability in the Linux kernel's ksmbd smb2_open function involves premature dropping of a reference to a durable file descriptor during the durable reconnect process. Specifically, ksmbd_put_durable_fd(fp) is called too early, causing the file pointer (fp) to become invalid if an error occurs later or if a scavenger accesses the file. This results in a use-after-free condition when accessing properties of fp, such as fp->create_time. The fix moves the reference drop to the end of the function to ensure fp remains valid until smb2_open returns.

This use-after-free vulnerability can lead to memory corruption within the kernel, potentially causing system instability or crashes. The CVSS vector indicates network attack vector with high impact on confidentiality, integrity, and availability, but requires high attack complexity and privileges. No known exploits in the wild have been reported.

A fix is available in linux-hwe-edge versions 7.0.0-28.28.1 and later. Users should update to these fixed versions to remediate the vulnerability. No additional mitigation steps are indicated.