A bug in the Linux kernel SMB client occurs during the smb2_open_file() operation where the system can experience a use‑after‑free or a double‑free if certain error buffer conditions are not satisfied. This flaw corrupts kernel memory. Based on the description, it is inferred that an attacker might influence the buffers, which could lead to arbitrary code execution or a system crash, thereby compromising integrity and availability.

All Linux kernel releases that include the SMB client prior to the commit applying the fix; any kernel version before the referenced commits is vulnerable per the advisory links.

The CVSS score is 9.8, and the EPSS score is below 1%, indicating a low probability of exploitation. The nature of the flaw—kernel‑level memory corruption—implies high damage if the issue is leveraged. The likely attack vector is remote via SMB traffic, but this is inferred because the description does not explicitly state the required conditions. No public exploitation evidence or CISA KEV listing exists, yet the vulnerability can be reached from a network space that can communicate over SMB. The overall risk remains significant, with high impact and low likelihood.