A double‑free bug resides in the Linux kernel SMB client module. When a response‑bearing request triggers a replayable error and frees its response buffer, a subsequent failure in SMB2_notify_init can cause the same buffer to be freed again before bookkeeping is reset, leading to memory corruption. This corruption can allow an attacker to execute arbitrary code in kernel space or cause a kernel panic.

All Linux kernel implementations are affected, as the vulnerability is embedded in the core SMB client component of the kernel. Any Linux host that employs SMB networking from user space or mounts SMB shares is potentially impacted.

The EPSS score is reported as less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating low observed exploitation activity. Nonetheless, a double‑free in the kernel can be leveraged by an attacker who can send crafted SMB traffic to a target host over the network. The attack vector is therefore inferred to be remote, network‑based, requiring SMB service interaction to trigger the flaw.