Executive brief
The ksmbd SMB server component in the Linux kernel fails to free preauthentication session objects when a client disconnects during the SMB3.1.1 multichannel negotiation phase. This causes a memory leak that can be triggered repeatedly, potentially exhausting system memory on servers handling many client connections.
Technical details
This is a memory leak vulnerability in the ksmbd SMB3 file server implementation within the Linux kernel. When SMB3.1.1 multichannel binding occurs, a preauthentication session object is allocated during NTLM negotiate and returned with STATUS_MORE_PROCESSING_REQUIRED. If the client disconnects before sending the authenticate request, neither the authenticate completion nor error cleanup paths deallocate this object. The fix initializes the preauth_sess_table list at connection allocation and adds a ksmbd_preauth_session_destroy() call during connection teardown to release any remaining preauth sessions. The vulnerability requires network access to an SMB server and can be triggered by abruptly disconnecting during the authentication handshake.
Affected products
- Linux Linux kernel versions supporting ksmbd (Linux 5.15+)
Timeline
- 2026-09-17: disclosed: CVE-2026-90169 published
- 2026-07-24: patched: Upstream fix committed by Namjae Jeon
- 2026-09-14: patched: Backported to stable kernel trees