The Linux kernel SMB client contains a use‑after‑free and bounds checking flaw that occurs while processing compound encrypted frames. A stale buffer pointer can be freed and later accessed, and an incorrect length calculation can cause the next command pointer to reference leftover ciphertext. An integer overflow in the upper bound check can also allow a header to be read from an invalid location. These bugs enable memory corruption in the kernel context and, if an attacker can supply crafted SMB traffic, could lead to a denial of service or potentially arbitrary code execution within the kernel.

All Linux kernel builds prior to incorporating the described patches are vulnerable. The issues reside in the SMB client code of the kernel; vendor and product name is the Linux kernel. Version information is not explicitly enumerated in the advisory, so any kernel containing the SMB client component before the fix is considered at risk.

The CVSS score of 8.8 indicates a high severity, and the presence of use‑after‑free and integer overflow in the SMB client suggests significant risk. The EPSS score of <1% indicates a very low current exploitation probability. The KEV catalog notes this vulnerability is not listed. The likely attack vector is an SMB client connection that processes compound encrypted frames; this inference is drawn from the description and is not explicitly stated as a proven exploit method. No public exploit is referenced, and the vulnerability is not yet in CISA’s KEV catalog, but the potential impact warrants immediate patching.