The CIFS subsystem in the Linux kernel contains a use‑after‑free flaw in the file‑size update routine. When a writable file handle fails to update its size via a handle‑based RPC, the code falls back to a path‑based operation that reuses a server link (tcon) that has already been freed by cifsFileInfo_put(). The resulting dereference of freed memory can corrupt kernel data structures and potentially lead to a crash or unauthorized code execution, thereby affecting system integrity and availability. The weakness is identified as CWE‑825.

All Linux kernel builds that include the CIFS driver and have not been patched with the fix that clears the tcon reference after cifsFileInfo_put(). This includes standard distribution kernels that have not applied the latest security update, as well as custom builds that retain the unpatched CIFS implementation.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need an SMB/CIFS session that attempts a file‑size change operation which fails, triggering the path‑based fallback. The attacker could be a remote client with SMB/CIFS access to the target system. The precise impact depends on the system context; reproducible exploitation could lead to kernel memory corruption but does not provide a guaranteed code‑execution pathway.