The flaw resides in the Linux’s SMB client code where the structure member ce->tgthint is left pointing to a freed cache_dfs_tgt object after free_tgts() clears all list entries. The dangling pointer is reused without resetting to NULL, which can lead to a use-after‑free situation. Inappropriate use of the freed memory can cause memory corruption, resulting in a crash or, if an attacker can control the free_tgts() caller, arbitrary code execution. The severity reflects a moderate attack potential reflected in the CVSS score of 7.1. This type of weakness traditionally falls under CWE-825, memory corruption through dangling references.

All Linux kernel installations are affected. No specific version information is supplied, so any system running a Linux kernel that includes the SMB client at the time of the vulnerability should be considered vulnerable until a patched release is applied.

The CVSS score of 7.1 indicates a moderate severity, while the EPSS score of less than 1% signals a low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires a malicious or compromised SMB server to trigger the fault, potentially allowing remote or local attackers to induce a use‑after‑free. Because it occurs in kernel code, a successful exploit could lead to privilege escalation or system instability. Until the bug is fixed, systems remain exposed—such result in denial of service or code execution.