A missing lock around the tc_count increment in the Linux kernel SMB client, specifically inside smb2_find_smb_sess_tcon_unlocked(), creates a race condition. This synchronization flaw, identified as CWE-362, can allow an attacker to corrupt kernel memory or trigger an out‑of‑bounds state during SMB session handling, potentially resulting in arbitrary code execution or a kernel panic.

All Linux distributions running a kernel version that lacks the committed patch 96c4af418586 or its successors are vulnerable. The flaw resides in the core SMB (CIFS) client module of the kernel and affects any system that mounts or accesses SMB shares using the built‑in SMB client.

The CVSS score of 9.8 signals a severe risk while the EPSS score of less than 1% indicates the current probability of exploitation remains low. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker might attempt to orchestrate concurrent SMB traffic to trigger the race condition, though such an attack path has not been demonstrated publicly.