Junglewise Threat Intelligence

CVE-2025-40285: Linux Kernel ksmbd reference count leak in smb2_sess_setup

CVE-2025-40285 · Severity: high · CVSS 7.5 · Published 2025-12-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's SMB server (ksmbd), which is used to share files over a network. Under certain conditions when a connection needs to be restarted, the system fails to properly release internal tracking markers. Over time, this can lead to a depletion of system resources, potentially causing the server to crash or become unresponsive to users.

Technical details

A reference count leak was identified in the smb2_sess_setup() function within the ksmbd component of the Linux kernel. When a connection requires a reconnect, the ksmbd_session reference count is not properly decremented, leading to a memory/resource leak. An attacker could potentially trigger this condition repeatedly over the network without authentication to exhaust system resources, resulting in a denial of service (DoS). The issue has been resolved by ensuring ksmbd_user_session_put() is called during the reconnection error path. Patches are available in various stable kernel branches including 6.1.y, 6.6.y, and 6.12.y.

Affected products

  • Linux Linux Kernel 6.1.121 to 6.1.159, 6.6.67 to 6.6.117, 6.12.6 to 6.12.59, 5.15.176 to 5.16, 6.13

Timeline

  • 2025-10-12: disclosed: Initial patch authored
  • 2025-12-06: advisory: CVE published by kernel.org and NVD

References

Related threats