In the Linux kernel SMB client, the compound_send_recv routine incorrectly handles error synchronization for compound requests. If a later operation in the compound sequence fails or is interrupted, an earlier CREATE may already have opened a remote SMB handle that is then released without invoking handle_cancelled_mid(). The omission leaves the remote handle open because the corresponding FID is not copied to the caller, resulting in a lingering handle. This flaw is a resource‑handling weakness that can lead to resource exhaustion and potential unauthorized access to the SMB share held by the open handle.

Linux kernel versions prior to the applied patch. All Linux distributions that ship with the vulnerable kernel code are affected, regardless of kernel flavour.

While no CVSS or EPSS score is publicly available, the lack of KEV listing suggests the vulnerability is not yet widely exploited but remains a serious concern for kernel maintainers. The vulnerability can be triggered by sending a crafted compound SMB packet from a remote client, which would cause the kernel to leave an opened handle after a subsequent failure. Attackers with network access to the SMB client can sustain this state repeatedly, potentially exhausting remote server handles or maintaining unauthorized access. The risk is exacerbated in environments where the SMB client processes many short‑lived connections. With the EPSS marked as not available, the exploitation probability can be considered uncertain but non-zero pending further analysis.