The vulnerability exists in the CIFS file close handling code of the Linux kernel. When a deferred close operation is canceled, a subsequent memory allocation may fail, causing the code to break prematurely and leave a reference to the CIFS file (cfile) unreleased. The leaked kernel‑space reference and the associated open server handle can accumulate over repeated failures. The resulting resource exhaustion can destabilize the kernel, leading to a denial‑of‑service condition.

All Linux kernel builds that contain the CIFS filesystem and have not yet incorporated the commit that adds the fix (32390b3f06f26e36) are affected. This includes ordinary production kernels and any custom builds that ship without the patch. The specific kernel versions are not enumerated, so any system using a vulnerable kernel is at risk.

The vulnerability does not provide an attack vector that enables arbitrary code execution; it requires kernel context and conditions that lead to a memory allocation failure. No public exploits exist and the EPSS score is < 1%, and the vulnerability is not in CISA’s KEV catalogue. The CVSS score of 5.5 indicates moderate severity. Consequently, the threat is moderate: a skilled attacker who can induce sufficient memory pressure or monitor resource usage could exploit the leak to exhaust kernel memory and disrupt services, but the likelihood of exploitation in the wild is low.