The kernel flaw occurs when a compound SMB request fails while the client is connected. The send routine initiates a reconnection but leaves pending mid identifiers on the queue before unlocking the server. As the reconnect walks the queue it releases resources twice, decrementing the in-flight counter twice and causing a WARN. The double decrement does not immediately crash the system but corrupts internal accounting, which could lead to further kernel instability or denial of service in SMB operations.

Linux systems running the Linux kernel prior to the patch that addressed this SMB client issue. The bug is present in all kernel releases containing the errant code path and affects any SMB client usage on those kernels.

The CVSS score is not publicly listed and EPSS is unavailable, but the bug is logged as a WARNING rather than an outright crash. There is no indication of remote code execution or privilege escalation. Exploitation would require an attacker able to force a send failure in an SMB transaction and then observe or rely on the inconsistent counter, making it a low likelihood attack vector. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited in the wild.