A critical double-free vulnerability in the Linux kernel SMB client allows unauthenticated remote attackers to potentially achieve arbitrary code execution or cause system crashes.

The vulnerability occurs when a response-bearing SMB attempt returns a replayable error and frees its response buffer. If the SMB2_query_directory_init function fails, the system fails to reset response bookkeeping, leading to a stale free of the memory buffer.

This flaw carries a CVSS score of 9.8, indicating a critical severity level. Because it is reachable over the network without authentication or user interaction, it poses a severe risk of unauthorized system access, data exfiltration, or complete denial of service. Successful exploitation could compromise the integrity and availability of any server utilizing the affected SMB client functionality.

Immediate Action: Apply the vendor-provided kernel updates to version 6.6.145, 6.12.96, 6.18.39, or 7.1.4 as applicable to your specific distribution.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process terminations associated with smb client activity.

Compensating Controls: If patching is not immediately feasible, restrict network access to SMB services to trusted internal segments and utilize host-based firewalls to limit exposure to untrusted traffic.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the lack of required authentication for exploitation, immediate patching is mandatory. Administrators should prioritize the deployment of the upstream fixes to all affected Linux environments to eliminate the risk of memory corruption and potential system compromise.