The vulnerability occurs in the Linux kernel CIFS client code within the cifs_file_set_size() function. When a writable file handle is found, the function borrows a tcon and server reference from the handle's tlink, attempts a handle-based set_file_size() RPC, and then releases the handle with cifsFileInfo_put(). If set_file_size() fails, the fallback path reuses the borrowed tcon and server pointers under a guard that checks if tcon is NULL. However, since tcon is not NULL, the guard is skipped. If cifsFileInfo_put() caused the last reference on a tlink to be dropped and freed (due to prior removal from the tlink tree during reconnection or session teardown), the subsequent use of tcon results in a use-after-free. The fix sets tcon to NULL after cifsFileInfo_put(), ensuring the guard triggers the path-based operation to acquire a fresh reference or fail cleanly, preventing use-after-free.

This vulnerability could lead to use-after-free conditions in the kernel CIFS client, potentially causing kernel crashes or memory corruption. The exact impact depends on exploitation, but use-after-free bugs in kernel code can lead to denial of service or privilege escalation.

A fix has been implemented in the Linux kernel to clear the tcon pointer after cifsFileInfo_put() in cifs_file_set_size(), preventing use-after-free. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.