Executive brief
The Linux kernel's SMB server module (ksmbd) fails to clean up procfs resources when module initialization encounters an error partway through startup. This leaves allocated proc tree structures and per-CPU counters in memory, causing a resource leak when the module load fails. While not immediately exploitable, this degrades system stability over repeated failed module initialization attempts.
Technical details
The vulnerability is a resource leak in the ksmbd SMB server module initialization code (fs/smb/server/server.c). When ksmbd_server_init() creates procfs entries via ksmbd_proc_init(), subsequent initializers (server_conf_init() or ksmbd_work_pool_init()) may fail. In those failure paths, the error handling jumps directly to class_unregister() without calling ksmbd_proc_cleanup(), leaving the proc tree and associated per-CPU counters allocated. The fix adds a new error label (err_proc_cleanup) that invokes ksmbd_proc_cleanup() before class_unregister() in the failure chain. This is a local condition triggered only when module initialization fails; remote exploitation is not possible. Patch is available upstream in the Linux kernel stable tree.
Affected products
- Linux Linux kernel affected versions prior to fix
Timeline
- 2026-09-17: disclosed: CVE published to NVD
- 2026-08-17: patched: Upstream fix merged by Namjae Jeon
- 2026-09-14: patched: Backported to stable tree by Greg Kroah-Hartman