Executive brief
The Linux kernel's SMB server component (ksmbd) fails to free memory allocated during user authentication, causing a gradual leak of 192-byte buffers each time a user logs in. Over time on systems handling many authentication attempts, this can exhaust available memory and impact system stability and availability.
Technical details
A memory leak exists in the ksmbd SMB server authentication code where the buffer returned by ksmbd_ipc_login_request_ext() is not freed after being passed to ksmbd_alloc_user() in two locations: fs/smb/server/auth.c (ksmbd_krb5_authenticate) and fs/smb/server/mgmt/user_config.c (ksmbd_login_user). The vulnerability is triggered during Kerberos authentication or standard login flows when a user account is processed. The fix adds kvfree(resp_ext) calls immediately after ksmbd_alloc_user() to unconditionally free the allocated buffer. This is a memory management issue with no direct remote code execution impact but affects service availability through resource exhaustion.
Affected products
- Linux Linux kernel versions containing commit a77e0e02af1c (ksmbd: add support for supplementary groups) through patched versions
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-08-17: patched: Upstream kernel patch committed by Namjae Jeon
- 2026-09-14: patched: Backported to stable kernel trees