The Linux kernel SMB client incorrectly handles a failure while parsing SMB2 CREATE contexts. When SMB2_open receives a response that is rejected by smb2_parse_contexts, the client returns without closing the handle that the server has allocated. This leads to an orphaned server‑side handle and an inflated num_remote_opens counter. The result is a resource leak that may allow a remote attacker to exhaust SMB server handles, causing denial of service or degraded service performance. The weakness is a classic unreleased resource problem.

This issue affects the Linux kernel SMB client implementation; all Linux distributions that ship the unpatched kernel are impacted. No specific versions are listed, so any kernel containing the SMB2 client code before the patch is vulnerable.

Based on the description, the attacker must be able to send or manipulate SMB2 traffic such that the client receives a malformed CREATE context, implying that the vulnerability is reachable via the network from hosts that can initiate SMB sessions to the vulnerable system. No CVSS score is provided, and the EPSS is not available, so the calculated risk is uncertain. The vulnerability is in the SMB client path, meaning an attacker only needs to be able to speak SMB to the target server. The exploit requires sending a malformed CREATE request that triggers a parse failure. Since the bug results in a resource leak, repeated exploitation could degrade or crash the SMB service, but the lack of a public exploit or known widespread exploitation reduces the immediate threat level. The vulnerability is not listed in CISA’s KEV catalog, which further suggests that it has not yet been widely exploited.