In the Linux kernel, the CIFS client uses a witness registration that stores a pointer to a tcon. The code frees the tcon while the registration still holds the pointer. When a second CIFS mount for the same share registers, the first registration may still reference the freed tcon, and subsequent operations that acquire tc_lock or increment tc_count use the stale pointer. This results in a use‑after‑free that can corrupt kernel memory, crash the system, or allow privileged code execution if an attacker can influence the notification path. The flaw is a classic memory corruption vulnerability (CWE‑825).

All Linux distributions that ship the affected CIFS client code in the kernel. No product or version restrictions are listed, so any kernel that has not yet been updated to include the fix is considered vulnerable.

The EPSS score is reported as less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploit activity is currently minimal. Nevertheless, the lack of a stable reference to the tcon makes the flaw highly internal – it could lead to denial of service or code execution in kernel mode if an attacker can trigger the notify path. The CVSS score is 7.8. The likely attack vector is local or remote access to CIFS shares that trigger the witness notification mechanism.