The Linux kernel SMB client included a flaw where a double‑free could occur during the SMB2_close replay path. A response‑bearing call that returned a replayable error freed its buffer, and a subsequent failure in SMB2_close_init() triggered cleanup that reused the stale buffer type and freed it again. This misuse of memory bookkeeping can corrupt the heap, raising the possibility of arbitrary code execution or a denial of service if an attacker can influence the SMB traffic. The exact outcome depends on the heap state at the time of exploitation.

The vulnerability affects all Linux kernel releases that contain the buggy SMB client code. No specific version information is listed, but any kernel that has not yet applied the patch will be vulnerable.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% shows a very low projected probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. If an attacker can send crafted SMB messages that trigger the SMB2_close replay path, the double free could lead to heap corruption. This might allow remote code execution or a crash, but such outcomes are inferred from the nature of the flaw and have not been explicitly demonstrated.