The flaw stems from the misuse of a broad lock in the CIFS subsystem of the Linux kernel. Earlier code protected many unrelated structures with a single global lock, later replaced by more granular locks, but some remaining uses still relied on the original lock for tcon fields. This mismatch allows concurrent access to sensitive tcon data without proper synchronization, creating a race condition that can corrupt CIFS state or cause kernel crashes. The weakness aligns with CWE-413, Incorrect Locking or Synchronization, and CWE-667, Race Condition.

All Linux kernel releases that lack the commit referenced by the patch identifier 8c59eeeeffa1524ef57e173a89a1a3ff539888d5 or newer are vulnerable. The issue is inherent to the CIFS driver and affects any distribution that ships an older kernel, regardless of vendor.

Exploitation requires an attacker able to generate simultaneous SMB traffic against the target system, implying network-level access to the CIFS/SMB service. Because the fault occurs in kernel code, an exploit could lead to kernel corruption or service disruption. The CVSS score is 8.8, but the EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is remote over the network and that successful exploitation would demand elevated privileges within the kernel. The CVSS score of 8.8 indicates high severity, but the lack of known public exploits suggests a moderate to high risk pending discovery of an attack method.