In Linux kernel SMB client code, the function that queues an oplock break mistakenly increases a reference count on a file without first confirming that the work item was queued. If a second oplock break arrives before the first work is processed, the queueing fails and the incremented reference is never released, leaking a reference. Repeated leaks can cause a build‑up of unreleased inodes, eventually leading to kernel panics during unmount operations, as the kernel reports a busy inode or dentry. This defect represents a denial‑of‑service condition that could be triggered by an SMB server that sends op‑lock break requests slowly or repeatedly.

The flaw exists in the Linux kernel SMB client implementation. The affected systems are Linux distributions that ship the Linux kernel with the unpatched SMB client code. No specific kernel versions are listed in the CVE data, so any system running a kernel that includes the vulnerable code before the patch is at risk.

The CVSS score and EPSS are not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no known active exploits. Nonetheless, the condition can be triggered by a malicious or misconfigured SMB server that issues repeated oplock break requests. The lack of a public exploit path limits the immediate threat, but the potential for a kernel panic and denial of service warrants prompt remediation. The vulnerability is exploitable from the perspective of an attacker controlling an SMB server or one with a slow response, making the risk moderate for environments that rely heavily on CIFS mounts.