The vulnerability resides in the CIFS SMB client of the Linux kernel. A race condition exists between the deferred close of a file during direct‑I/O writes and the unmount routine. When an unmount occurs before the deferred close completes, a dentry reference remains, triggering a BUG warning about a busy dentry. This misuse of a reference count and failure to release resources in a timely manner can lead to kernel instability or a crash, potentially forcing a system reboot and disrupting availability.

All Linux kernel builds that include the CIFS client and lack commit c68337442f03 or later are affected. The exact version range is not specified in the CNA data, but distribution kernels published prior to that commit or custom kernels retaining the original CIFS implementation are vulnerable. The error is triggered only when a CIFS share is mounted with the dio (direct‑I/O) option and a write operation occurs before unmounting. Shares mounted without dio or on filesystems other than CIFS are not impacted.

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% reflects a very low exploitation probability. The likely attack vector is local privileged access that allows the attacker to mount a CIFS share with dio, perform a write, and then unmount before the deferred close work has drained. Exploitation requires precise timing and is constrained to systems where this specific sequence occurs. If successful, the race can trigger a kernel panic or forced reboot, compromising system availability.