The Linux kernel’s CIFS SMB client contains a use‑after‑free flaw in cifs_try_adding_channels(). When the function cifs_ses_add_channel() fails, it releases a reference to the interface structure before updating iface->weight_fulfilled. A concurrent interface list refresh can remove the reference while channel creation is still in progress, causing the last reference to be released and the interface object to be freed. Incrementing weight_fulfilled afterward then accesses freed memory. Exploitation of this memory corruption could, in theory, allow an attacker to execute arbitrary code or crash the kernel, but the description does not confirm a specific exploitation path. The apparent attack vector is interaction with the CIFS client, likely via SMB traffic or filesystem operations that trigger channel creation and failure.

All Linux kernel releases that include the CIFS SMB client before the patch commit that fixed cifs_try_adding_channels() are affected. The vulnerability is not tied to a particular distribution or kernel version; it applies to any kernel containing the vulnerable code until an updated kernel with the fix is installed.

The CVSS score and EPSS information are not provided, so the exact severity and likelihood of exploitation are unknown. However, use‑after‑free vulnerabilities in the kernel are generally considered high risk because they can lead to arbitrary code execution or denial of service. The vulnerability is not listed in the CISA KEV catalog, indicating that no publicly known exploits or widespread incidents have been documented yet. The likely attack path involves provoking a CIFS channel‑creation failure while a concurrent interface refresh occurs, which would require special conditions on the client or server side. Security professionals should treat this as a high‑priority kernel issue and act to remediate it promptly.