The vulnerability arises from a race condition in the Linux kernel’s SMB server when managing receive credits. The counter that tracks posted receive buffers and granted credits is not isolated, so a peer could consume a credit while the kernel is still processing the previous receive. During the brief window where the kernel grants additional credits before the initial grant has been fully accounted for, the available credit count can temporarily exceed the number of actually posted buffers. This inconsistency may lead the SMB server to believe it has more credits than it actually does, which can result in the service using more resources than intended and potentially causing a denial of service.

The issue is present in the SMB server code of the Linux kernel itself; it is not confined to a specific distribution. All kernel releases that include the current SMB implementation before the patch – including those preceding version 6.18 – are affected unless the system’s kernel has been upgraded to a version that incorporates the indicated fix. The vulnerability affects all architectures supported by the Linux kernel’s SMB stack.

The CVSS score of 7.5 places this flaw in the high severity range. An EPSS score of below 1 % indicates that the probability of real‑world exploitation is currently low. The flaw can be triggered via normal SMB traffic from any network host that can reach the SMB server provided by the kernel. The likely attack vector is a remote SMB request, inferred from the description that the vulnerability is activated by SMB traffic. As it is not listed in the CISA KEV catalog, no large‑scale active exploitation is known. However, the potential for denial of service warrants prompt attention.