In the Linux kernel, this flaw occurs when a compound SMB request fails while the client is connected. The send routine initiates a reconnection but leaves pending mid identifiers on the queue before unlocking the server. As the reconnect walks the queue it releases resources twice, decrementing the in-flight counter twice and causing a WARN. This double decrement is a violation of proper resource accounting, an instance of the CWE-459 weakness (Arbitrary Resource Release), which can corrupt internal accounting and lead to further kernel instability or denial of service in SMB operations.

Linux systems running the Linux kernel prior to the patch that addressed this SMB client issue. The bug is present in all kernel releases containing the errant code path and affects any SMB client usage on those kernels.

The CVSS score is 6.5 and the EPSS score is less than 1%, but the bug is logged as a WARNING rather than an outright crash. There is no indication of remote code execution or privilege escalation. Exploitation would require an attacker able to force a send failure in an SMB transaction and then observe or rely on the inconsistent counter, making it a low likelihood attack vector. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited in the wild.