A double‑free of the smc_spd_priv structure occurs when the tee(2) system call duplicates a splice pipe buffer within the Linux kernel’s SMC subsystem, a classic double‑free vulnerability (CWE-415). The duplicated buffers share the same smc_spd_priv pointer, so when either pipe is released the cleanup routine frees the same private data twice, triggering a use‑after‑free (CWE-911) that escalates to a NULL‑pointer dereference and a kernel panic. The crash effectively denies all services running on the affected machine because the kernel dies. Based on the description, it is inferred that the double‑free can be triggered by calling tee or splice on an SMC socket, which requires the process to have local access to such a socket. The kernel panic results in a system‑wide denial of service, preventing all kernel services from operating normally.

The vulnerability exists in any Linux kernel that implements the SMC splice path without the patch that adds a refcount to smc_spd_priv. In practice this includes all unpatched kernel releases before the commit that introduced the fix, meaning most distributions deploying kernels older than the update. Users with a functioning SMC socket that can invoke tee or splice are affected. It is inferred that any distribution using an unpatched kernel before the fix is vulnerable, given the vendor list of Linux:Linux.

The CVSS score for this issue is 7.8 and the EPSS score is below 1%, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Attackers require local access to an SMC socket and can induce the double‑free by performing tee or splice operations, resulting in a kernel panic and a denial‑of‑service condition. Based on the description, it is inferred that the attacker must have local privileges or direct control of an SMC socket; no remote exploitation path is indicated. No public exploit is known, but the crash susceptibility warrants immediate remediation.