A malformed secondary SMB transaction can trigger a use‑after‑free in the CIFS client layer of the Linux kernel. When a valid primary TRANSACT2 response is followed by a secondary response that is rejected because the SMB header is invalid or the PDU fails validation, the client logic overwrites the response buffer pointer. The resulting dangling pointers are later reused by a demultiplexer thread, exposing kernel memory and potentially allowing privilege escalation or denial of service. The flaw is rooted in improper handling of buffer references and improper access with incorrect lengths, identified by CWE‑825.

The flaw resides in the Linux kernel’s CIFS (SMB) client implementation. Any kernel that includes CIFS client support and lacks the patch applied in the recent commit is vulnerable. Versions preceding the patched release are at risk until updated.

The CVSS score is 7.1. EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can send a crafted SMB response to a client can exploit the dangling pointers, potentially gaining kernel privileges or crashing the system. The exploit requires a malicious SMB server interacting with the client, so exposure is limited to systems that connect to SMB over a network. Given its high severity and potential impact, the vulnerability should be considered high risk.