In the Linux kernel SMB client, a race condition between DFS automount expiration and superblock reference handling allows a raw superblock pointer to be freed before an active reference is taken. This creates a deterministic use‑after‑free that can corrupt memory and potentially enable arbitrary code execution.

The flaw resides in the Linux kernel; specific affected release numbers are not listed. All systems running a kernel version that implements the SMB client DFS code prior to the fix are potentially vulnerable.

The CVSS score is not provided and EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog, so the quantitative threat level cannot be precisely measured. However, the race produces a use‑after‑free that could be exploited by an attacker able to trigger the automount process, giving the ability to corrupt kernel memory or achieve privilege escalation. The lack of public exploitation knowledge suggests low to medium likelihood, but the severity of a kernel‑level memory corruption remains high.