The Linux kernel SMB client function receive_encrypted_standard() allocates a temporary buffer called next_buffer before verifying that the number of compound PDUs has not exceeded the configured maximum. If the limit check fails, the function returns without assigning the buffer to the server’s small or big buffers, leaving it leaked. This represents a Missing Release of Resource (CWE‑772) and a memory leak that can accumulate enough to exhaust the kernel heap, causing a denial‑of-service for processes that rely on SMB. The vulnerability does not compromise confidentiality or integrity; it attacks availability.

All Linux kernels that include the SMB client and have not integrated the patch that moves the MAX_COMPOUND check before buffer allocation are impacted. This spans any distribution shipping the unpatched kernel and any custom kernel build retaining the vulnerable code path. No specific version list is provided, so any unpatched build containing the affected function is at risk. No affected version information is available.

The EPSS score is reported as less than 1 % and the flaw is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. It is inferred that an attacker could trigger the leak by sending crafted SMB packets to a client process listening on the network; each trigger releases a buffer that is never freed, and repeated exploitation could deplete system memory. Because the flaw requires network interaction, the attack vector is remote SMB. The CVSS score of 5.5 classifies the vulnerability as moderate severity; the primary risk remains availability, with no impact on confidentiality or integrity.