CVE-2022-50856

Vulnerability

In the Linux kernel's CIFS client, the function cifs_ses_add_channel() allocates a transaction ID (xid) but fails to free it before all return paths. This oversight leads to a resource leak, as the xid is never released back to the pool.

Exploitation

An attacker with the ability to trigger the cifs_ses_add_channel() code path—such as by initiating a multi-channel session setup—can cause repeated xid leaks. No special privileges beyond normal CIFS client usage are required; the leak occurs during routine channel addition operations.

Impact

Each leaked xid consumes a slot in the global xid table, which is a finite resource. Over time, repeated exploitation can exhaust available xids, leading to denial of service (DoS) where new CIFS operations fail to obtain an xid and thus cannot proceed.

Mitigation

The fix, committed in the Linux kernel stable tree, adds a free_xid() call before every return in cifs_ses_add_channel() [1][2]. Users should apply the corresponding kernel patch or update to a version containing the commit.