In the Linux kernel SMB client, the compound_send_recv routine fails to cancel earlier MID operations when subsequent waits are interrupted or later MIDs fail during response synchronization. This oversight allows an earlier CREATE operation to succeed and obtain a remote SMB handle, yet the handle is released without invoking handle_cancelled_mid(). Consequently, the remote file ID is not copied to the caller and the handle remains open on the server. The flaw is a resource‑handling weakness (CWE‑772) that leaves handles orphaned on the server.

All Linux kernel builds that contain the legacy compound wait code before the applied fix are affected. This includes every distribution that ships with a kernel version prior to the kernel revision that contains the patched compound_send_recv implementation.

The CVSS score of 3.3 indicates a low overall impact, and the EPSS score of <1% suggests a very low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a crafted compound SMB packet sent from a remote client to the SMB client over the network; this is inferred from the description that the issue occurs during compound request processing. An attacker would need network access to the SMB client and would trigger a compound CREATE followed by a later failure that prevents proper cancellation of the earlier MID. If exploited repeatedly, the remaining open handles could affect the server’s handle capacity.