The vulnerability is a double‑free bug in the Linux kernel SMB client, triggered when query_info fails and a replayable error is returned. A response buffer is freed twice, leading to memory corruption and also representing a use‑after‑free condition (CWE‑1341). This can cause a kernel panic, disrupt services, and might allow an attacker to exploit the corrupted state for privilege escalation, although no direct remote code execution is recorded.

All Linux kernel releases that implement the SMB2 query_info path before the fix was applied. The advisory lists Linux as the affected vendor and product but does not specify particular kernel versions.

The EPSS score for this vulnerability is below 1%, indicating a low exploitation probability, and it is not listed in the CISA KEV catalog. The CVSS score is 9.8. The likely attack vector is network‑based via the SMB protocol; a malicious or misconfigured SMB server could trigger the error path and double‑free the client buffer. While the impact is primarily denial of service and potential local privilege escalation, the overall risk is constrained by the low likelihood of exploitation and the requirement for a vulnerable SMB client to be active.