The CVE involves a use‑after‑free in the Linux kernel SMB client. When the demultiplex thread exits, clean_demultiplex_info() cancels only the server echo delayed work while leaving the reconnect delayed work scheduled. The server structure is then freed, and the queued reconnect work later dereferences the freed structure. This undefined memory access can corrupt kernel memory, potentially causing a kernel panic or other instability but does not explicitly prove code execution. This problem is linked to CWE-825, an Improper Handling of Payload leading to a Security Problem.

All Linux kernel releases that contain the SMB client code before the patch are affected, including mainline kernels from multiple years and downstream distributions that have not yet adopted the remediation. The fix is present in subsequent kernel versions that incorporate the updated clean_demultiplex_info() logic.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% and absence from the CISA KEV catalog suggest a low likelihood of active exploitation. The failure can lead to kernel memory corruption that may result in a denial of service or, in some configurations, privilege elevation if an attacker can control freed memory contents. The likely attack vector is remote SMB traffic that triggers a reconnection attempt in the vulnerable client; based on the description, it is inferred that an attacker could deliver specially crafted SMB packets to an affected host to invoke the reconnect logic. However, code execution has not been confirmed in the available data.