An incorrect initialization in the way the Linux kernel tracks SMB client connections caused a doubly‑linked list to be created with NULL ‘prev’ and ‘next’ pointers instead of pointing to the list head. The list_empty() check always reported the list as non‑empty, leading to a NULL dereference when adding a new node. Additionally, concurrency in the signal routine allowed the same server node to be added twice, corrupting the list further. This corruption can trigger a kernel panic, resulting in a loss of service on the affected system.

All Linux kernel releases that include the SMB client implementation prior to the integration of commit 04082b1833..., which fixed the race condition and initialization bug. Since no official version range was provided, the issue applies to every kernel that has not yet applied the patch. Distribution kernels that have not incorporated the upstream change are also affected.

Because the flaw resides in kernel SMB client code, a remote attacker could send crafted SMB requests to a vulnerable host to cause list corruption, or a local attacker with sufficient privileges could generate concurrent CIFS connections to exploit the race; this inference is based on the description. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, yet the potential for a kernel crash and the accessibility of the SMB interface make the risk high. The CVSS score of 7.5 underscores the high severity of the issue. Immediate attention is advised.