The Linux kernel SMB client contains a race during creation of the CIFS demultiplex thread. The worker thread may access the tcp_ses structure before the parent thread has fully populated it, without any synchronization, which can lead to memory corruption. Additionally, the kthread_run macro can start the thread before the thread pointer is set; if the kernel is preempted after the thread is spawned but before the pointer is populated, the thread may suspend and wait for a SIGKILL that will never arrive. Both conditions can trigger a kernel panic and a loss of service.

All Linux kernels that expose the SMB client component and have not yet incorporated the patch are affected. This includes mainstream distributions that ship kernels prior to the commit that introduced the race‑condition fix (commit 0eee1e6c).

The CVSS score is 5.5 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote SMB traffic that triggers the race condition; this inference is based on the fact that the race occurs when the CIFS demultiplex thread is created in response to SMB traffic. Exploitation could lead to a kernel crash and denial of service, though no exploitation activity has been reported to date. The risk remains significant because the flaw can cause a system‑wide kernel failure without any advanced privileges or special conditions.