Executive brief
A vulnerability was identified in the Linux kernel's SMB server component (ksmbd), which is used to share files over a network. An error in how the system tracks active file handles could allow a remote attacker to cause a resource leak. Over time, this could lead to a system crash or a denial-of-service condition, impacting the availability of shared files and network operations.
Technical details
A reference count leak exists in the ksmbd component of the Linux kernel within the parse_durable_handle_context() function in fs/smb/server/smb2pdu.c. The vulnerability occurs when a durable handle request is processed as a replay operation and returns an -ENOEXEC error; in this specific code path, the ksmbd_file reference count is not properly decremented. A remote, unauthenticated attacker can exploit this by sending specially crafted SMB2 packets to trigger the leak repeatedly. This exhaustion of kernel resources eventually leads to a denial-of-service (DoS) condition. Patches have been released for various stable kernel branches including 6.6.124, 6.12.70, and 6.18.10.
Affected products
- Linux Linux Kernel 6.6.32 to 6.6.124, 6.9 to 6.12.70, 6.13 to 6.18.10
Timeline
- 2025-12-29: patched: Initial fix committed to mainline kernel
- 2026-02-14: advisory: CVE-2025-71204 published