The Linux kernel SMB client had a flaw where a double‑free could occur during the SMB2_close replay path. When a response‑bearing call returned a replayable error, the response buffer was freed, and if SMB2_close_init() failed before the next send, the cleanup code reused the stale buffer type and freed it again. This misuse of memory bookkeeping can corrupt the heap, potentially enabling an attacker that can manipulate SMB traffic to trigger arbitrary code execution or cause a denial of service.

The vulnerability affects all Linux kernel releases that contain the buggy SMB client code. No specific version information is listed, but any kernel that has not yet applied the patch will be vulnerable.

The exploit requires crafting SMB requests that invoke the faulty close routine, which can be performed remotely over the network. Because the double free can corrupt heap objects arbitrarily, it is a high impact vulnerability. EPSS is not available, KEV not listed, and CVSS not defined, but the severity can be inferred as high. Organizations using SMB clients on Linux should consider the risk of remote code execution or crash until a patch is applied.