In the Linux kernel SMB client, cifs_queue_oplock_break() unconditionally increments a file reference count before confirming that the work item was queued. If a second oplock break request arrives before the first is processed, queue_work() fails to enqueue the second work and the reference count is never decremented. The accumulated reference leak can grow large enough to cause the kernel to report a busy dentry during a CIFS unmount, triggering a BUG and resulting in a kernel panic and denial of service.

The flaw exists in the Linux kernel SMB client code that is shipped with many Linux distributions. Any system running a kernel containing this code before the patch commits referenced in the advisory, and that mounts CIFS/SMB shares using that kernel, is affected.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, implying that no active exploits are known. An attacker with control over an SMB server that can send repeated or delayed oplock break requests can trigger the reference leak until a unmount operation forces the kernel to panic. Because the exploitation requires interaction with an SMB server, casual attacks are unlikely, but environments heavy on CIFS mounts should treat the risk as moderate.