The Linux kernel contains a reference count leak in the CIFS client that only occurs when the "multiuser" option is enabled and the function cifs_sb_tlink() fails. Normally the reference acquired by cifs_queue_oplock_break() is released, but in the failure path cifs_oplock_break() returns without dropping the reference and a subsequent unmount attempts to release a busy inode, triggering a kernel crash. This defect is classified as CWE-911, indicating an improper handling of reference counts that can lead to resource exhaustion or denial of service. This defect was identified only through code review and was never exercised at runtime, but the defect would cause a denial of service by crashing the system when a CIFS share is unmounted after such a failure.

All Linux kernel releases are potentially affected until the patch that fixes the reference count handling in cifs_sb_tlink() is applied. The vulnerability is specific to the CIFS client component and would affect any system that mounts CIFS (SMB) shares with the "multiuser" option enabled. The exact kernel version range impacted is not specified in the advisory.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. However, the defect could be triggered by an attacker who can force the CIFS client to operate in multiuser mode and induce a cifs_sb_tlink() failure, leading to a crash when the share is unmounted. The CVSS score of 5.5 indicates moderate severity, but the impact on critical kernel components suggests that the vulnerability could cause a denial of service if the condition can be reproduced. The likely attack vector is inferred from the description: local or remote where the attacker can influence CIFS mounts through network or local control, although the lack of an existing exploit implies low current risk.