CVE-2025-39819

Root

Cause

The vulnerability lies in the Linux kernel's SMB client code, specifically in the function smb2_compound_op. The function's contract requires that a reference to the cfile structure be dropped after execution. However, one control flow path—when memory allocation for local variable vars fails—does not perform this cleanup, leading to a reference count inconsistency. This omission can result in a resource leak, as described in the official CVE description.

Attack

Vector and Prerequisites

Exploitation occurs when the kernel is performing a SMB compound operation and a memory allocation failure (returning -ENOMEM) triggers the buggy path. No special authentication or network position is required beyond what is normal for mounting a SMB share; the vulnerability is triggered internally by the kernel's memory management. An attacker cannot directly force a memory allocation failure but could potentially influence it through system resource exhaustion.

Impact

If triggered, the reference to cfile is not properly released, causing a reference count leak. This can lead to resource exhaustion over time, potentially degrading system performance or leading to denial of service. The impact is limited to availability; there is no evidence of privilege escalation or information leakage.

Mitigation

The fix adds a new goto label "out" to ensure cleanup logic is executed even on the -ENOMEM path. The error is not replayable, so replay logic is also skipped. The patch has been applied to the Linux kernel stable tree. Users should update to a kernel version containing commit ab529e6ca1f6 or its backport [1][2][3][4].