The ksmbd subsystem in the Linux kernel contains a reference‑count bug that causes durable file descriptor leakage when a CreateGuid matches but the ClientGUID differs. In this mismatch path the kernel retains an extra reference to a cached file entry and never releases it, leaving the global file table entry permanently pinned. Each repeated request that meets this condition adds a leaked descriptor, eventually consuming kernel file descriptor capacity and potentially interrupting normal operation. This flaw is categorized as a memory and resource leak (CWE‑401, CWE‑772).

The vulnerability targets the Linux kernel’s ksmbd SMB2/3 server component. Any kernel release that includes the flawed durable‑handle lookup logic prior to the patch is susceptible. The CVE data does not specify exact kernel versions, so all builds before the commit that addresses the issue should be considered vulnerable.

The CVSS base score of 5.5 reflects moderate severity, while the EPSS score of <1 % indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. A remote attacker can trigger the bug by repeatedly sending SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 messages over an SMB session with a mismatched ClientGUID. Because the defect does not expose data directly, the primary impact is resource exhaustion, but in concert with other kernel weaknesses the denial of service could be amplified. Exploitation requires network access to an SMB service and does not rely on elevated privileges.