The Linux kernel SMB client has a flaw in handling reference counts for cifsFileInfo structures during deferred close operations. When a close is queued, the reference to the file info is passed to workqueue processing, but due to a race between flag clearing and work scheduling, the reference is not always dropped. This leaves the reference count elevated and associated resources such as tlink, dentry, and server handle leaked, potentially exhausting memory or handles. Maintaining an inflated reference count can lead to a denial of service if the leaking continues.

All Linux kernel versions that employ the legacy CIFS close logic are potentially vulnerable until the patch commit 5520e89a5a4f834bced64cf2ac927001cc513a40 is applied. The fix is included in kernel updates across major distributions, so any kernel pre‑update may be exposed. System administrators should verify that their Linux kernel packages include the referenced commit or a later security release.

EPSS score is <1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. The CVSS score is 5.5, reflecting moderate severity. It is inferred that the attack vector requires an attacker to trigger a deferred close on the SMB client, likely via crafted SMB packets or local privileged execution. If reference leaks accumulate, the system could run out of memory or descriptors, causing a denial of service. Because no official workaround is documented, the risk remains until the kernel includes the patch that correctly manages cifsFileInfo references.