In the Linux kernel, the krb_authenticate function frees session user data without nulling the pointer and may not reinitialize the pointer when reauthentication occurs. Subsequent SMB2 session setup functions then reference the freed memory, creating a use‑after‑free condition. The affected code may allow an attacker to trigger memory corruption that can lead to denial of service or arbitrary code execution, a classic CWE‑416 vulnerability.

The flaw affects the Linux kernel shipped with Debian 11 and all Linux kernel releases up to and including the 6.15 release candidates (RC1 and RC2). All distributions carrying those kernel versions are potentially impacted until the patch is applied.

The CVSS score of 7.8 indicates a high impact, and the EPSS score of less than 1% suggests low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can likely exploit the flaw remotely by sending crafted SMB/Kerberos requests, as the code path is reachable from network traffic.