A missing lock around the tc_count increment in the Linux kernel SMB client, specifically inside smb2_find_smb_sess_tcon_unlocked(), creates a race condition. This synchronization flaw, identified as CWE-414, can allow an attacker to corrupt kernel memory or cause an out-of-bounds state during SMB session handling, potentially resulting in arbitrary code execution or a kernel panic.

All Linux distributions running a kernel version that lacks the 96c4af418586 patch and its successors are affected. The vulnerability resides in the core SMB (CIFS) client module of the kernel, impacting any system that mounts or accesses SMB shares using the built-in SMB client.

The CVSS score of 9.8 signals a severe risk while the EPSS score of less than 1% indicates the current probability of exploitation is low. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker might try to orchestrate concurrent SMB traffic to trigger the race condition, but this remains speculative.