A critical race condition vulnerability in the Linux kernel SMB client allows unauthenticated remote attackers to potentially achieve remote code execution.

This is a concurrency flaw (CWE-362) located within the smb2_find_smb_sess_tcon_unlocked function. Due to a missing lock during the tc_count increment, an unauthenticated attacker can trigger a race condition, leading to severe system instability or exploitation.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to system integrity, confidentiality, and availability. Successful exploitation allows an attacker to manipulate kernel-level operations without authentication, which could lead to a full system compromise, data theft, or denial of service across enterprise storage environments.

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainer, ensuring the kernel is updated to at least version 6.6.142, 6.12.92, 6.18.34, or 7.0.11.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unusual SMB connection resets that may indicate attempts to trigger race conditions.

Compensating Controls: Restrict access to SMB services at the network level using firewalls to allow only trusted traffic, which reduces the attack surface for remote exploitation.

Public Exploit Available: Unknown

Given the critical severity of this kernel-level flaw, administrators must prioritize the deployment of the provided kernel updates. Patching should be performed during the next maintenance window, or immediately for systems exposed directly to untrusted networks, to mitigate the risk of remote code execution.