The Linux kernel SMB client contained a vulnerability due to an incomplete backport of a previous fix addressing a potential use-after-free in smb2_close_cached_fid(). Specifically, the cfids_invalidation_worker() function missed a necessary kref_put() call that should have been replaced with close_cached_dir(). This incomplete backport could lead to memory management errors with potential high impact on system security. The vulnerability is tracked as CVE-2025-68226 and has a CVSS 3.1 vector indicating network attack complexity is low, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an attacker to cause a use-after-free condition in the SMB client code of the Linux kernel, potentially leading to arbitrary code execution or denial of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability, meaning sensitive data could be exposed or modified, and system stability could be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch links or vendor advisories are provided, users should monitor official Linux kernel security announcements for updates addressing CVE-2025-68226 and apply patches promptly once available.