An internal reference count leak exists in the CIFS SMB client code of the Linux kernel. The bug causes three separate call paths to cifs_sb_tlink to fail to decrement the reference counter for cifs_sb_tlink objects, allowing the counter to grow unbounded. As the kernel exhausts available kernel memory or other resources associated with these objects, it can lead to a denial of service.

The flaw resides in the Linux kernel that powers all Linux distributions. No specific vendor version is listed, but any instance of the kernel that includes the CIFS client module before the patch is potentially affected. This includes production servers and desktop systems that mount SMB shares via CIFS. The commit references point to upstream kernel revisions, so all kernel releases after the fix, but before it, are at risk.

The CVSS base score is 5.5, which places it in the medium severity band, and the EPSS score is below 1%, indicating a low likelihood of public exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to invoke SMB mount operations that trigger cifs_sb_tlink paths; therefore the attack vector is most likely local or requires elevated privileges to mount large numbers of SMB shares. Although publicly disclosed exploits are unavailable, the potential for resource exhaustion makes the risk significant enough to warrant timely remediation.