A race condition exists in the Linux kernel SMB client when two concurrent query interface operations attempt to update interface information without proper locking. The flaw allows both operations to modify shared data, leading to inconsistent or corrupted kernel data. It is classified as CWE-362. If the corrupted state spreads beyond the SMB client, the kernel can become unstable, potentially causing crashes or denial of service.

The vulnerability is identified for Linux kernel 5.19 and its release candidate builds rc4 through rc8. No explicit information is available regarding older or other kernel versions, so the impact on those is uncertain.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% reflects a low exploitation probability as of the current data. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector likely requires an attacker to generate concurrent SMB client queries—such as through a trusted or compromised host—thereby triggering the race. No public exploits have been reported, and the risk remains theoretical until a proof‑of‑concept is demonstrated.