The Linux kernel SMB client contains a double‑free bug in the SMB2_flush() routine. When a flush response can be replayed, the routine keeps the response buffer from a previous attempt in memory. If the retry fails before a new response is stored, the old buffer pointer is freed twice, corrupting kernel memory. This improper deallocation can trigger a kernel crash or, if an attacker can craft SMB traffic, allow execution of arbitrary code with kernel privileges. The weakness is a use‑after‑free fault.

The flaw is present in all Linux kernel releases that have not yet incorporated the patch commits detailed in the kernel changelog for the SMB client (e.g., commit 013a9a3d and the stable releases that follow). Any system running an affected kernel and acting as a Samba client that receives flush requests is potentially vulnerable until the kernel is updated. The issue is confined to the SMB client side of the kernel and does not affect Samba servers directly.

The EPSS score is reported as less than 1%, indicating a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the CVSS score of 9.8 reflects high severity if exploited, due to possible kernel memory corruption leading to elevation of privilege. Exploitation would require an attacker able to send crafted SMB packets to a vulnerable host and is likely to operate over the network. Given the low current exploitation probability, the recommended response is to patch promptly rather than rely solely on monitoring.