Executive brief
A memory leak has been identified in the Linux kernel's SMB client code. When SMB2 read requests fail under certain error conditions, allocated request buffers are not properly released, potentially allowing memory exhaustion over time if retried repeatedly.
Technical details
The vulnerability is a resource leak (CWE-404) in the SMB2 read request path (smb2_new_read_req). The function allocates a request buffer via smb2_plain_req_init() but returns early on two error paths without releasing the buffer to the caller. Specifically, early returns on NULL server check and memory registration failures bypass the buffer handoff that occurs at the end of the function. The asynchronous read path (smb2_async_readv) cannot clean up because the buffer assignment never occurs. When -EAGAIN is returned from memory registration, the retry mechanism in smb2_async_readv() causes repeated allocation leaks. No authentication or special network access is required—the leak occurs on the kernel memory allocator during normal SMB read operations. The fix is to ensure all error paths properly release or hand back the allocated buffer.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix applied to resolve buffer leak in smb2_new_read_req error paths