In the Linux kernel SMB client, compound SMB2 requests that begin with a CREATE operation are handled incorrectly when the following command fails. The code continues to use the CREATE response without validating it, records the file identifier as open, and increments the open‑handle counter. This improper initialization and type handling can cause the kernel to believe a handle is open when it is not, leading to an inflated handle count and potential resource exhaustion or corruption. The flaw is an example of CWE‑771 weakness.

The vulnerability exists in all Linux kernel builds that include the SMB client interface, regardless of version, until the patch commits are applied. The affected vendor is Linux and the product is the Linux kernel itself, with no specific kernel version ranges indicated, meaning any kernel prior to the official patch is susceptible.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. EPSS is below 1%, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is a malicious or malformed SMB2 request sent by an attacker to the kernel SMB client; this inference is based on the description which describes errors in handling compound requests. Because the flaw requires network‑level SMB access and does not expose a direct user‑level trigger, the threat to most environments is moderate, especially when SMB client usage is frequent and no patch is applied.