The vulnerability, identified as CWE-649 and CWE-787, lies in the Linux SMB client’s write handling: during an SMB2_write operation, the payload buffer is encrypted in place, and if a retry occurs because of a replayable error, the same corrupted buffer is sent again. This causes the written data to be overwritten with ciphertext, leading to permanent data corruption on the remote file system. The effect is a loss of data integrity, potentially resulting in corrupted files or system state. The issue appears most often when connections are unstable and retries are triggered, so an attacker who can influence SMB traffic or control a flaky network could induce data corruption.

Affected products are Linux kernel implementations that use the SMB client code before the 6.10 release, including kernels prior to the netfs conversion. Versions before 6.10 are vulnerable. The kernel code paths used for sync writes and certain filesystem features such as SFU mknod and MF symlinks are impacted.

The CVSS score of 8.1 indicates high severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV, which suggests that it has not yet been widely exploited in the wild. However, because SMB traffic is generally user‑controllable and network instability can be manipulated, the risk remains significant for environments that rely on SMB shares. The attack vector is likely a combination of vulnerable SMB client code and unstable network conditions that trigger write retries, making the flaw exploitable under normal operation or by an attacker who can force extended retry cycles.