The flaw is a race condition in the Linux kernel’s SMB Direct implementation, where the module mishandles the tracking of receive credits. It may grant credits that have already been consumed by a peer, potentially leading to resource exhaustion or incorrect data handling. The weakness is classified as a race condition (CWE‑362) that affects SMB Direct credit management, and also intersects with kernel‑specific race conditions (CWE‑821).

All Linux kernels that ship SMB Direct support, across all distributions, are potentially affected. No specific version range is listed, so any kernel lacking the fix commits remains vulnerable.

With a CVSS score of 7.5 the vulnerability is considered high severity, however the EPSS score of less than 1 % indicates a low probability of exploitation. It is not currently listed in the CISA KEV catalog. An attacker would need to interact with the SMB Direct protocol on a target system, likely from the network, to exploit the race window and stress the connection or cause a denial of service.