The vulnerability is a double‑free bug in the Linux kernel SMB client’s SMB2_open() routine. A response-bearing attempt can generate a replayable error and free its response buffer. If SMB2_open_init() fails before the subsequent send, the cleanup logic attempts to free the prior response again, causing a stale free. This memory corruption flaw, classified as CWE-1341, can potentially be exploited to execute arbitrary code on the vulnerable system. Based on the description, it is inferred that an attacker can craft malicious SMB traffic to trigger the double‑free, leading to control over the host process.

The flaw affects any Linux distribution that uses a Linux kernel containing the SMB client module. The vendor and product identifiers reference Linux:Linux, and no specific kernel versions are listed; therefore the issue may exist in any kernel that implements the unpatched SMB2_open() logic.

The EPSS score indicates a very low exploitation probability (less than 1 %). The CVSS score of 8.8 reflects a high severity. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending crafted SMB traffic to the target machine that acts as an SMB client. Because the flaw requires the SMB client to encounter a replayable error, an attacker would need to trigger such a scenario, which could be achieved by exploiting fault conditions within the SMB protocol. If successfully exploited, the double‑free could lead to memory corruption and arbitrary code execution at the privilege level of the kernel process.