The vulnerability, identified as CWE-649, lies in the Linux SMB client’s write handling: during an SMB2_write operation, the payload buffer is encrypted in place, and if a retry occurs because of a replayable error, the same corrupted buffer is sent again. This causes the written data to be overwritten with ciphertext, leading to permanent data corruption on the remote file system. The effect is a loss of data integrity, potentially resulting in corrupted files or system state. The issue appears most often when connections are unstable and retries are triggered, so an attacker who can influence SMB traffic or control a flaky network could induce data corruption.

Affected products are Linux kernel implementations that use the SMB client code before the 6.10 release, including kernels prior to the netfs conversion. Versions before 6.10 are vulnerable. The kernel code paths used for sync writes and certain filesystem features such as SFU mknod and MF symlinks are impacted.

The CVSS score of 7.0 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in CISA KEV, which suggests that it has not yet been widely exploited in the wild. However, because SMB traffic is generally user‑controllable and network instability can be manipulated, the risk remains significant for environments that rely on SMB shares. The attack vector is likely a combination of vulnerable SMB client code and unstable network conditions that trigger write retries, making the flaw exploitable under normal operation or by an attacker who can force extended retry cycles.