A bug in the Linux kernel SMB client occurs during the smb2_open_file() operation, where the system can either experience a use‑after‑free or a double‑free if certain conditions on error buffers are not met. This defect can corrupt kernel memory, and depending on the attacker’s ability to influence the buffers, could allow execution of arbitrary code or cause a crash, both of which compromise system integrity and availability.

All Linux kernel releases that include the SMB client prior to the commit that implements the fix. The patch is referenced by several commit URLs in the advisory, meaning any kernel version before those commits is vulnerable.

The CVSS severity is not listed, and EPSS data is unavailable, but the nature of the flaw—kernel‑level memory corruption—implies high impact if exploited. The vulnerability is remotely exploitable through SMB traffic, and no public exploitation evidence or CISA KEV listing exists, yet the upper‑layer anonymous nature of SMB connections means attackers can reach the buggy code from a network space. Consequently, the risk remains significant and should be mitigated as soon as possible.