An uninitialized variable in the SMB2 client’s unlink operation can trigger a kernel Oops, resulting in a system crash. The flaw arises because iovs set by SMB2_open_init or SMB2_close_init may be left uninitialized when those calls fail, such as during a reconnect. When smb2_unlink() then attempts to free or modify these uninitialized I/O vectors, the kernel panics. This weakness combines use‑of‑uninitialized data (CWE‑824) with improper resource cleanup (CWE‑908), causing a denial of service in the form of a kernel crash.

The vulnerability exists in the Linux kernel SMB client code before the inclusion of commit 048efe12. Kernels released prior to 6.17 and early 7.0 RC releases (rc1 and rc2) contain the uncorrected logic. Any Linux distribution running an unpatched kernel with SMB client capability enabled is affected, regardless of the distribution vendor.

The CVSS score of 5.5 denotes a medium severity, while the EPSS score below 1 % indicates a very low likelihood of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further reducing the observed threat level. The likely attack vector is remote, via malicious or misconfigured SMB traffic that forces the SMB client to experience a reconnection failure, but it could also be triggered locally by simulating such failures. Based on the description, the exact exploitation method is not detailed and is inferred from the kernel behavior.