The vulnerability in the Linux kernel SMB client involves a double-free condition in the SMB2_close() function. When a response-bearing attempt returns a replayable error and frees its response buffer, a subsequent failure in SMB2_close_init() before the next send causes cleanup to incorrectly free the same response buffer again. This improper handling of response buffers can lead to memory corruption. The issue was fixed by resetting response bookkeeping before each attempt to avoid freeing stale buffers multiple times.

The vulnerability can cause memory corruption in the Linux kernel SMB client due to a double-free condition. This may lead to system instability or potential exploitation depending on the context in which the kernel is used. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.