Executive brief
A vulnerability in the Linux kernel's SMB server component (ksmbd) could allow a local user to cause a denial-of-service condition. By triggering specific connection failures, an attacker can cause the system to incorrectly track active connections, eventually preventing new legitimate connections from being established. This affects systems using the ksmbd module for file sharing.
Technical details
A memory/resource leak exists in ksmbd_tcp_new_connection() within the Linux kernel's SMB server. When kthread_run() fails during the creation of a new TCP connection, the system calls free_transport() instead of ksmbd_tcp_disconnect(). This results in a failure to decrement the 'active_num_conn' counter. An attacker with local access can repeatedly trigger this failure path to artificially inflate the connection count until it reaches the maximum allowed limit, effectively blocking all subsequent SMB connections. The issue has been resolved by ensuring the proper disconnect function is called to manage the counter correctly.
Affected products
- Linux Linux kernel 5.15.91 to 5.15.201, 6.1.9 to 6.1.164, 6.2.1 to 6.6.125, 6.7 to 6.12.72, 6.13 to 6.18.11, 6.19 to 6.19.1
Timeline
- 2026-02-18: disclosed
- 2026-02-18: advisory
References
- https://git.kernel.org/stable/c/599271110c35f6b16e2e4e45b9fbd47ed378c982
- https://git.kernel.org/stable/c/6dd2645cf080a75be31fa66063c7332b291f46f0
- https://git.kernel.org/stable/c/77ffbcac4e569566d0092d5f22627dfc0896b553
- https://git.kernel.org/stable/c/787769c8cc50416af7b8b1a36e6bcd6aaa7680aa
- https://git.kernel.org/stable/c/7ddd69cd1338c6197e1b6b19cec60d99c8633e4f
- https://git.kernel.org/stable/c/baf664fc90a6139a39a58333e4aaa390c10d45dc
- https://git.kernel.org/stable/c/cd25e0d809531a67e9dd53b19012d27d2b13425f