The Linux kernel SMB server has a flaw where the function that finalizes data transmission, send_done, can be called for a request that lacks the IB_SEND_SIGNALED flag. In such a case the code mistakenly assumes the request will be cleaned up during the final flagged request. If an unflagged request is processed before a flagged one, the missing cleanup can corrupt kernel memory or crash the system, resulting in a denial of service. This bug is an instance of CWE-166, an improper use of a pointer or inadequate handling of a control flag.

The vulnerability applies to all Linux kernel releases that include the SMB server component and have not incorporated the recent commit that fixes the send_done handling logic. No specific version ranges are enumerated in the advisory, so any kernel older than the patched state is potentially vulnerable.

With a CVSS score of 9.8 this flaw is classified as critical, yet the EPSS score of less than 1% suggests current exploitation activity is very low. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit the vulnerability by sending specially crafted SMB requests that trigger a send_done call without the IB_SEND_SIGNALED flag. The likely attack vector is through the SMB protocol, possibly by an attacker who can reach the SMB service on the target machine.