Linux ksmbd EUVD-2026-80309

Exploitation requires the target Linux host to be running the ksmbd in-kernel SMB3 server (CONFIG_SMB_SERVER) with an active export, and the attacker must be able to establish an SMB2 session - so authentication is required unless the share permits guest/null sessions. The concrete trigger is a race: an SMB2 TREE_CONNECT must be in-flight in smb2_tree_connect() at the same moment a concurrent session LOGOFF erases the tree-connection xarray entry and drops its reference, freeing the object before the handler finishes using it. Limiting factors: ksmbd is not enabled by default (most Linux SMB servers run userspace Samba instead), exploitation depends on winning a tight concurrency window (making reliable exploitation hard and non-automatable), and a valid session is normally needed to reach the tree-connect code path.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is the Linux kernel CNA's characteristic auto-assigned maximal score and is over-stated for this bug. The vulnerability is a use-after-free in ksmbd's smb2_tree_connect() triggered by a race between publishing a new tree connection and a concurrent session LOGOFF freeing it. Two facts contradict the 9.8: (1) an SMB2 TREE_CONNECT is only reachable after a client has completed session setup, so exploitation requires an established SMB session (PR:L, not PR:N) unless the export permits guest/null sessions; and (2) it is a narrow concurrency race requiring precise timing to win against logoff teardown (AC:H, not AC:L). Realistically this is closer to CVSS ~7.5. Supporting signals reinforce lower urgency: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code is referenced. SSVC-style read: exploitation status is 'none' (no public exploit identified), automatable is 'no' (requires a valid session plus a timing race, not a simple scan-and-hit), technical impact is 'total' (kernel-context memory corruption from a UAF, potentially escalatable to code execution or at minimum a crash/DoS). Net: a legitimately serious in-kernel memory-corruption bug that warrants prompt patching where ksmbd is enabled, but NOT a drop-everything 9.8 mass-exploitation threat. The headline score and 'Information Disclosure' tag both mischaracterize it.

An attacker with (or able to obtain) valid credentials to a Linux host running the ksmbd in-kernel SMB server opens a session and issues an SMB2 TREE_CONNECT while concurrently issuing a session LOGOFF, racing the handler so the tree-connection object is freed by logoff cleanup while smb2_tree_connect() still references it. Winning the race yields a kernel use-after-free that can crash the server (DoS) or, with heap grooming, be steered toward privilege escalation. No public exploit code is identified at time of analysis, and the tight timing window makes reliable exploitation non-trivial.