The Linux kernel's SMB client had a double-free vulnerability in the SMB2_flush() function. When a replayable flush response is received, and a retry subsequently fails before storing a replacement response, the cleanup function flush_exit frees the stale response pointer twice. The patch reinitializes the response buffer type and response I/O vector at the beginning of the replay loop, preventing double-free errors without altering the replay handling for successful requests.

This vulnerability could lead to memory corruption in the Linux kernel SMB client due to double-free of memory, which may cause system instability or potential denial of service. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits are reported in the wild.

A fix for this double-free vulnerability has been implemented in the Linux kernel. Since no explicit patch links or affected versions are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed — check the vendor advisory or Linux kernel mailing lists for current remediation guidance.