The vulnerability in the Linux kernel arises from the cifs_issue_read() function failing to release transaction credits when a read request errors. Because the credits counter is never decremented on failure, subsequent operations can exhaust the available credits, eventually causing read operations to stall or the CIFS protocol stack to become unresponsive. This flaw represents a CWE‑772 issue concerning resources that have not been freed during error handling, allowing an attacker or faulty process to loop with repeated failures and degrade the stability of the CIFS client.

All Linux kernel builds that include the cifs filesystem and lack the fixation commit are affected. Systems running older kernel versions without this patch possess the flaw; the exact version ranges are not listed in the CVE data.

The EPSS score of < 1% indicates a very low probability of exploitation in the wild, but the condition still requires network access to a CIFS share from a client capable of causing read failures. The attack scenario is likely local or network, involving a malicious or misconfigured client issuing repeated failed read requests. Because the fault is in kernel space, it does not grant direct code execution but can lead to resource exhaustion and service disruption. No exploitation records or KEV listing exist, suggesting limited public exploitation to date, yet the impact on affected services is potentially high if the condition is met.