The Linux kernel SMB client contains a flaw where match_session() incorrectly reuses an existing Kerberos‑authenticated SMB session even when a different username= option is specified. As a result, a mount that supplies a new Kerberos principal continues to authenticate with the original principal, allowing a user to access shares with an unintended identity. This bypasses authentication controls and can expose sensitive data, effectively granting unauthorized operations. The weakness is classified as CWE-488.

All Linux kernel installations that have not incorporated the recent patch are affected. The issue exists in the generic Linux OS, specifically the SMB client component used for CIFS/SMB mounts. No particular upstream vendor or kernel release is singled out beyond the generic Linux kernel; any system running a kernel older than the patched commit is potentially vulnerable.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw does not provide remote code execution; exploitation requires an attacker to influence mount operations on a client machine or to compromise a SMB server that accepts the reused session. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active attacks at present. Nevertheless, administrators should treat this as a high risk that permits unauthorized access to shared resources and should patch promptly.