Executive brief
A memory leak vulnerability was identified in the Linux kernel's SMB client when using SMB Direct (RDMA) connections. This issue occurs when the system fails to properly release memory during a failed connection negotiation. Over time, this could lead to memory exhaustion, potentially causing system instability or a denial of service.
Technical details
A memory leak (CWE-401) exists in the Linux kernel's SMB client implementation, specifically within the 'smbdirect_recv_io' component. The vulnerability is located in the 'smbd_negotiate()' function in 'fs/smb/client/smbdirect.c' (or 'fs/cifs/smbdirect.c' in older versions). When a receive operation fails during the SMB Direct negotiation phase, the kernel fails to call 'put_receive_buffer()', leaving allocated objects in the kmem cache. An attacker with local access could potentially trigger this error path repeatedly to exhaust system memory. Patches have been released for various stable kernel branches including 6.1.154, 6.6.108, 6.12.49, and 6.16.9.
Affected products
- Linux Linux Kernel 4.16 to 6.16.9
Timeline
- 2025-10-04: disclosed
- 2025-10-04: advisory
References
- https://git.kernel.org/stable/c/0991418bf98f191d0c320bd25245fcffa1998c7e
- https://git.kernel.org/stable/c/3d7c075c878ac844e33c43e506c2fa27ac7e9689
- https://git.kernel.org/stable/c/5aa69aabcb275a8012265233c7694076ce1d9102
- https://git.kernel.org/stable/c/922338efaad63cfe30d459dfc59f9d69ff93ded4
- https://git.kernel.org/stable/c/aa4cf7615328eae44f3b4bf5f4fde3fb390c27c6
- https://git.kernel.org/stable/c/daac51c7032036a0ca5f1aa419ad1b0471d1c6e0
- https://git.kernel.org/stable/c/e7b7a93879558e77d950f1ff9a6f3daa385b33df