A flaw in the Linux kernel allows an asynchronous SMB request to remain pending when the server closes a connection. The pending request is not cancelled, causing the connection to hang as the kernel waits for the request to finish. This results in a denial of service, preventing clients from completing disconnection and potentially exhausting resources.

The vulnerability applies to all Linux kernel implementations that include the SMB server component. Any kernel without the commit that cancels pending async SMB requests when closing a connection is affected. The issue is documented as a kernel bug, not tied to a specific kernel release.

The CVSS score is 6.5, indicating a medium severity vulnerability. The EPSS score is less than 1%, indicating a very low but non-zero probability of exploitation. The vulnerability is not listed in CISA KEV. Because the flaw produces a denial of service that can be triggered remotely by an SMB client that induces a pending asynchronous request and then disconnects, the risk is significant for systems exposing SMB services. The likely attack vector is through SMB traffic, where an attacker can manipulate the server into leaving a request pending, causing the server to hang during connection teardown.