Executive brief
The Linux kernel's ksmbd SMB server subsystem contains a memory leak in the session registration function. When a session registration fails, the session object is not properly freed from memory, gradually consuming system resources. This can lead to memory exhaustion and potential denial of service if an attacker repeatedly triggers failed session setup attempts.
Technical details
A resource leak vulnerability exists in the ksmbd_session_register() function in fs/smb/server/mgmt/user_session.c. When the xa_store() call fails during SMB session registration, the session object is added to the sessions_table with a reference count of 2, but only one reference is released during error handling, leaving one reference leaked. The vulnerable code path is: __session_create() sets refcnt to 2 and adds to sessions_table → ksmbd_session_register() fails on xa_store() → ksmbd_user_session_put() only decrements refcnt to 1, preventing deallocation. The fix removes the session from sessions_table and explicitly calls ksmbd_user_session_put() again if xa_store() fails, ensuring proper cleanup. This is a kernel-level memory leak affecting the SMB server implementation accessible over network.
Affected products
- Linux Linux Kernel affected versions prior to patch commit 99b25b046e47e4904373cfeb445c5483f1633d88
Timeline
- 2026-09-17: disclosed: CVE-2026-90152 published
- 2026-09-14: patched: Fix committed to stable kernel trees