Executive brief
The Linux kernel's SMB/CIFS client implementation, used to mount network file shares, had a resource leak bug that could occur during network timeouts. When multiple requests timed out, the system would reconnect but fail to properly clean up in-flight message identifiers, potentially leading to message and credit tracking corruption. This could degrade performance of SMB connections or cause them to become unusable over time.
Technical details
The vulnerability is a resource leak in the CIFS demultiplex thread (fs/smb/client/connect.c). When STATUS_IO_TIMEOUT responses exceed a threshold (MAX_STATUS_IO_TIMEOUT=5), the code initiates reconnection but does not properly return message IDs (mids), credits, or decrement in-flight request counts before reconnecting. This causes the server->in_flight counter to become inconsistent and leaves mids allocated. The fix moves the reconnection check to occur after response decryption, allowing mid cleanup code to execute before reconnection, and defers the actual reconnect call until all pending MIDs have been processed. The attack vector is network-based (triggered by server timeouts), requires no authentication, and impacts availability of SMB connections.
Affected products
- Linux Linux kernel affected versions in multiple stable branches; patched upstream commit 69cba9d3c1284e0838ae408830a02c4a063104bc
Timeline
- 2025-10-04: disclosed: Published on NVD
- 2023-07-14: patched: Upstream patch commit 69cba9d3c1284e0838ae408830a02c4a063104bc by Shyam Prasad N