The vulnerability stems from a use‑after‑free bug in the Linux kernel SMB client. During channel addition, the code iterates over the interface list while holding a lock, then releases the lock while attempting to add a channel. Concurrently, an interface refresh can free inactive interfaces. If the iterator steps onto a freed interface, the code dereferences memory that has already been deallocated, causing a kernel fault. This flaw can trigger a kernel panic, disrupting the entire system and providing an availability loss. The description does not mention a direct path to code execution, and no mechanism for privilege escalation is explicitly documented.

The flaw exists in the Linux kernel’s SMB client (cifs). Any Linux distribution that has not applied the upstream patch containing the commit that adds the use‑after‑free fix is vulnerable. Because no specific kernel versions are listed, all vulnerable kernel releases prior to the update that includes the fix are at risk.

The EPSS score is <1%, with a CVSS score of 7.5. The flaw is not listed in the CISA KEV catalog, yet the nature of the bug—a kernel use‑after‑free that leads to a crash—implies high severity. Attackers would need to initiate or interfere with SMB traffic to trigger the refresh and the race; this could likely originate from remote or local SMB traffic. Based on the description, it is inferred that SMB traffic is required, but the CVE does not explicitly specify the attack vector. While the exact likelihood of exploitation remains unclear, the EPSS score and the potential for denial of service raise the overall risk to high.