The vulnerability is located in the Linux kernel’s net/smc subsystem. When a Client Link Control (CLC) decline is received before the link group setup completes, smc_clc_wait_msg() attempts to update link‑group synchronization state that has not yet been initialized. This premature access can lead to undefined behavior. Based on the description, it is inferred that the erroneous state update could trigger kernel instability or a crash, effectively causing a denial‑of‑service condition for services that rely on the SMC interface.

All Linux kernel releases that include the net/smc subsystem and have not incorporated the commit that added a guard around link‑group updates are potentially vulnerable. This applies to every distribution that ships the unpatched kernel code, regardless of version number, because the flaw resides in the core kernel source.

The CVSS score of 7.5 indicates a high severity level. The EPSS score of <1% reflects a very low probability of exploitation. The CVE is not listed in the CISA KEV catalog. The vulnerability is reachable only via the SMC network interface, meaning an attacker would need to generate or influence SMC traffic to invoke the bug. This specialized attack surface results in a moderate overall risk, with a low likelihood of successful exploitation in most environments.