Linux Kernel EUVD-2026-25430

Exploitation requires: (1) Local system access as an authenticated user (PR:L in CVSS vector), (2) Active SMB server service running on the target system, (3) Ability to send SMB protocol messages via smbdirect socket connection, (4) Kernel version prior to 6.18.11, 6.19.1, or 7.0. This is NOT a remote attack-network-based SMB connections alone are insufficient; the attacker must have local system login credentials or be a local user. Systems with SMB server disabled or not listening on any interface are not vulnerable. Default Linux installations typically do not enable SMB server, limiting real-world exposure.

Despite the moderate CVSS score of 5.5, this vulnerability presents limited real-world exploitation risk. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) correctly reflects that only local authenticated users can trigger the denial of service-this eliminates the majority of potential attackers. The EPSS score of 0.02% (4th percentile) strongly indicates this is not actively exploited and lacks widespread exploitation potential. The impact is restricted to availability (A:H) with no confidentiality or integrity loss, and unscoped (S:U) meaning only the vulnerable service crashes, not other system resources. This is a legitimate kernel stability issue affecting SMB server availability, not a critical security flaw. Organizations running Linux as an SMB server should prioritize patching, but this does not constitute an urgent security incident for most deployments, particularly those not actively using the SMB server feature.

A local user with standard privileges authenticates to a Linux system running SMB server services. The attacker sends specially crafted SMB protocol messages through the smbdirect channel that trigger empty send operations, causing the kernel's credit management to corrupt the reassembled data stream. The kernel's SMB server process crashes, denying service to legitimate SMB clients attempting to access shared resources.