Executive brief
The Linux kernel's ksmbd SMB server component contains a memory leak in the file locking handler. When processing SMB3 file lock requests, allocated memory is not freed when asynchronous work setup fails or when a process is interrupted, causing memory to accumulate and potentially leading to denial of service through resource exhaustion.
Technical details
The vulnerability is a use-after-free and memory leak in the smb2_lock() function within fs/ksmbd/smb2pdu.c. The argv buffer is allocated to handle asynchronous lock operations but is not freed in two code paths: when setup_async_work() fails and when the process is woken up after waiting. The fix adds explicit kfree(argv) calls after ksmbd_vfs_posix_lock_wait() returns, ensuring memory is released regardless of the work state. This is a kernel-mode memory management issue requiring no authentication or network interaction beyond SMB protocol access to affected systems running vulnerable kernel versions.
Affected products
- Linux Linux kernel Vulnerable versions prior to the patch (fixed in stable branches)
Timeline
- 2025-12-30: disclosed: Published on NVD
- 2023-03-10: patched: Upstream fix committed to Linux kernel stable trees