The Linux kernel’s SMC driver contains a use‑after‑free flaw in the smcr_port_err() function. The routine walks the smc_lgr_list.list without acquiring smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it is still being referenced. The vulnerability is classified as CWE‑825, and its exploitation could cause arbitrary kernel code execution or a kernel crash, resulting in a denial of service.

All Linux kernel releases that ship the SMC (Session Management Control) driver prior to the commit that locks smc_lgr_list during traversal are affected. No specific version range is disclosed, so any kernel version lacking the posted fix is considered vulnerable.

The EPSS score of less than 1 % indicates a very low probability of public exploitation. With a CVSS score of 4.7 the vulnerability is medium severity and it is not listed in the CISA KEV catalog. The race requires concurrent SMC operations and a cleanup routine; based on the need to invoke SMC interfaces, it is inferred that an attacker would need local or elevated privileges. No publicly available exploits are documented, and the low EPSS score further mitigates the threat.