The core of the vulnerability is a use‑after‑free in the netfs_read_gaps() routine of the Linux kernel, a flaw classified as CWE-825. When CIFS file reads are processed, the function creates a temporary sink page that is released too soon, leaving a dangling reference that KASAN reports as a UAF. If an attacker can cause the code path to run, the dangling reference can be overwritten with arbitrary data, enabling the attacker to corrupt kernel memory or trigger code execution from malicious input. This flaw can therefore lead to a full kernel compromise or a denial‑of‑service by crashing the kernel.

Affected systems include any Linux kernel that has not incorporated the netfs_read_gaps patch. The advisory details a failure observed in version 7.0.0, and the same issue applies to earlier upstream releases until the commit that fixes the early page release is merged into distribution kernels. Any distribution that uses the base Linux source without the change, particularly those providing CIFS or SMB support, is vulnerable.

The CVSS score of 9.8 marks the flaw as high severity, while the EPSS score of less than 1% indicates a very low probability of widespread exploitation at the time of analysis. The vulnerability is not in CISA’s KEV catalog. The likely attack vector is remote, mediated by a CIFS client that can send specially crafted read requests to a vulnerable server. Successful exploitation requires the CIFS subsystem to be enabled and reachable from the attacker’s network, making exposure through insecure network configurations a key risk factor.