The smc driver contains a race condition where a connection is freed while its receive tasklet remains armed. This results in a dangling reference to a freed ghost send buffer, leading to a use‑after‑free that can corrupt kernel memory and cause a crash or arbitrary code execution. The weakness is an error handled incorrectly scenario (CWE‑825). privilege escalation if an attacker can trigger the fault.

All Linux kernel implementations, as the vulnerability is tied to the generic smc driver and no specific kernel version or patch level was provided. Users of any distribution that ship the affected smc driver should treat this as a broad kernel issue.

The assigned CVSS score of 7.0 indicates a moderately high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploitation probability is uncertain but could be high once a suitable trigger is discovered. The likely attack vector is inferred to be local or remote code execution through crafted network traffic to the smc interface, as the flaw involves kernel tasklet handling of incoming packets. Exploitation would require the attacker to trigger the race condition before the tasklet is drained, which could be achieved by sending specifically timed packets to the smc connection, though the exact method is not disclosed in the available data.