Executive brief
A vulnerability was identified in the Linux kernel's SMB file-sharing server (ksmbd). An error in how the system manages user sessions can lead to a resource leak, potentially allowing an attacker to cause a system slowdown or crash by exhausting available memory. Patches have been released to address this issue across several stable versions of the kernel.
Technical details
A reference count leak exists in the ksmbd module of the Linux kernel within the session lookup logic. When ksmbd_session_lookup_all identifies a session that is not in the SMB2_SESSION_VALID state, it fails to decrement the reference count acquired during the lookup process. This flaw allows an attacker to trigger repeated reference count increments without corresponding decrements, eventually leading to resource exhaustion. The issue is resolved by explicitly calling ksmbd_user_session_put when an invalid session state is encountered. Fixes are available in kernel updates for the 5.15, 6.1, 6.6, 6.12, and 6.13 branches.
Affected products
- Linux Linux Kernel 5.15.176 to 5.15.203, 6.1.121 to 6.1.160, 6.6.67 to 6.6.120, 6.12.6 to 6.12.64, 6.13-rc1 to 6.13-rc6
Timeline
- 2025-12-14: other: Patch authored
- 2026-01-23: disclosed: Vulnerability published
References
- https://git.kernel.org/stable/c/02e06785e85b4bd86ef3d23b7c8d87acc76773d5
- https://git.kernel.org/stable/c/0fb87b28cafae71e9c8248432cc3a6a1fd759efc
- https://git.kernel.org/stable/c/11fe566b442e3bc2774191740fd377739a87a1c0
- https://git.kernel.org/stable/c/8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7
- https://git.kernel.org/stable/c/cafb57f7bdd57abba87725eb4e82bbdca4959644
- https://git.kernel.org/stable/c/e54fb2a4772545701766cba08aab20de5eace8cd