Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) allows unauthenticated remote users to cause a memory leak. By sending specially crafted network packets during the initial connection phase, an attacker can exhaust system memory over time. This can eventually lead to a system slowdown or a complete service outage.
Technical details
A memory leak exists in the ksmbd component of the Linux kernel due to improper handling of SPNEGO tokens during the ASN.1 BER decoding process. When ksmbd_decode_negTokenInit() processes a mechToken, it allocates memory immediately; however, if subsequent elements in the same blob are malformed, the decoder returns an error and sets a flag that causes the cleanup routine to skip the necessary kfree() call. This path is reachable pre-authentication, allowing a remote attacker to trigger incremental memory exhaustion. The fix removes the conditional check that prevented the memory from being freed and adds a fallback free in ksmbd_conn_free().
Affected products
- Linux Linux kernel 5.15 to 7.0.1
Timeline
- 2026-04-24: advisory: Initial disclosure date
- 2026-04-06: patched: Patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6
- https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162
- https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1
- https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1
- https://git.kernel.org/stable/c/ae9cdb29efed20ffdee9ff3b0bb72fb369c353da
- https://git.kernel.org/stable/c/bd4a7fb04f06f419b0e93d8b52fe32067eb312d1
- https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604