The vulnerability in the Linux kernel SMB client involves improper handling of response buffers in the query_info() function. Specifically, a response-bearing attempt that returns a replayable error frees its response buffer. If SMB2_query_info_init() subsequently fails before sending the next request, the cleanup process mistakenly frees the previous response buffer again due to retained stale bookkeeping. This double-free flaw was addressed by resetting the response bookkeeping before each attempt to avoid freeing the same buffer twice.

The vulnerability could lead to memory corruption in the Linux kernel SMB client due to a double-free condition. This may cause system instability or crashes. No known exploits in the wild have been reported. The exact impact depends on how the kernel handles the double-free scenario, but it generally poses a risk of denial of service or potential escalation of privileges if exploited.

A fix has been implemented in the Linux kernel to reset response bookkeeping before each query_info() attempt, preventing the double-free. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel security advisories for the current remediation guidance.