The Linux kernel SMB client contains a flaw where file creation operations (O_CREAT) on non‑regular inodes such as symlinks do not properly close the server handle and fail to call the function that releases the dentry reference. This results in a reference leak that can accumulate over time and consume kernel memory, degrading performance or ultimately causing a denial of service. The weakness is a resource management failure. If leveraged repeatedly, an attacker could trigger the leak through SMB share operations to exhaust system resources. The vulnerability is a CWE‑404 Resource Leak.

The issue affects the Linux kernel; the specific version(s) vulnerable are not enumerated in the data but are identified by the kernel commit URLs provided. The flaw exists before the commits that introduce the fix and applies to all Linux kernel users who rely on the SMB client (cifs) to communicate with SMB/CIFS file servers.

No CVSS score is supplied, and EPSS information is not available, so the quantified risk is indeterminate. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Nonetheless, the attack vector is likely remote via SMB/CIFS traffic, requiring the client to perform O_CREAT operations on non‑regular inodes. The potential impact is limited to resource exhaustion, not direct code execution or privilege escalation. Given the lack of exploitation data, the immediate risk appears moderate, but the possibility of a DoS makes patching or mitigation advisable.