The Linux kernel SMB client contains a flaw where an invalid target hint can cause get_tgt_name() to return an error pointer while subsequent code assumes a valid hint and dereferences it. This leads to a NULL pointer dereference that crashes the kernel, resulting in a denial of service. The weakness is a null dereference (CWE‑476). The impact is confined to the local system, as the fault occurs entirely in kernel space and does not expose data, but it can force the system to reboot or become unresponsive.

All Linux kernel versions shipped by distributions prior to the hardening commit that fixes DFS cache handling are affected. The vulnerability applies to the generic Linux kernel across vendor implementations; no specific version list is provided in the advisory, so administrators should verify if their kernel contains the patch commit.

No CVSS or EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation at this time. Based on the description, the likely attack vector is remote SMB traffic that exercises the DFS cache path. If an attacker can send such traffic to a vulnerable host, the probability of successful exploitation is high because the kernel crash occurs immediately upon the null dereference. Administrators should consider the risk moderate to high for exposed systems and prioritize patching.