A use‑after‑free flaw exists in the Linux kernel’s CIFS module, specifically when a secondary channel is no longer supported by the server. The function cifs_chan_skip_or_disable() releases the channel reference with cifs_put_tcp_session() and then continues to use the server pointer, potentially freeing the primary server before it is signaled for reconnect. This memory corruption can allow an attacker to execute arbitrary kernel code, effectively compromising the entire system.

All Linux kernels that enable CIFS multichannel support are affected. The CNA data lists only the general Linux kernel, with no specific version range, so any kernel lacking the corresponding patch is vulnerable.

The CVSS score is 8.1, indicating high severity. The EPSS score is < 1%, suggesting exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local or requires an attacker with authenticated access to CIFS sessions, such as a compromised client or an administrator on the same host. The risk remains significant because kernel code execution would grant full system control.