CVE-2025-40268

The vulnerability is a memory leak in the smb3_fs_context_parse_param function of the Linux kernel's CIFS/SMB3 client. When a user calls fsconfig twice without freeing the previously allocated source string (ctx->source or fc->source), the kernel fails to reclaim the memory from the first call, resulting in two leaked 96-byte buffers per double call, as reported by syzbot. [1][2]

To exploit the issue, a local user with permission to configure CIFS mount contexts can repeatedly invoke fsconfig with different parameters, causing the kernel to allocate new source strings each time while the old ones remain unreferenced. No authentication or special privileges beyond the ability to mount CIFS shares are required. The leak is triggered purely by the sequence of system calls.

An attacker could exhaust system memory by triggering a large number of these leaks, leading to a denial of service. Each leak is small (96 bytes), but accumulation over many calls can deplete memory resources, potentially causing system instability or crashes.

The fix, which releases the source memory before each parsing, has been committed to the Linux kernel stable tree. Administrators are advised to apply the corresponding stable kernel update. As of publication, no evidence of exploitation in the wild has been reported. [1][2]