CVE-2025-68295

Vulnerability

CVE-2025-68295 is a memory leak in the Linux kernel's CIFS (Common Internet File System) client, specifically in the cifs_construct_tcon() function. The CIFS client is used to mount SMB shares. The vulnerability occurs when a mount is configured with the domain= option (e.g., domain=ZELDA) and multiuser, and when the cifscreds utility is used to add credentials are added. In this scenario, cifs_set_cifscreds() sets the @ctx->domainname field, which is allocated via kstrdup(). However, before cifs_construct_tcon() returns, this allocated memory is not freed, causing a memory leak [1][2][3].

Exploitation

The leak is triggered by normal CIFS operations in a multiuser environment. An attacker who can induce an unprivileged user (on a system with such a mount) to perform file operations (e.g., ls) on the mount point will cause the leak to occur. The kernel memory leak is reproducible by scanning with kmemleak, as shown in the kernel changelog. The attack surface is limited to systems that use the specific CIFS configuration (multiuser mount with a domain= option) and where a user adds CIFS credentials via cifscreds. No special privileges beyond having access to the mount are required to trigger the leak.

Impact

Over time, repeated triggering of this memory leak can exhaust system memory, potentially leading to denial of service (resource exhaustion) for the affected system. The leak is small (8 bytes per occurrence in the reported test) but can accumulate. There is no indication of privilege escalation or data corruption; the impact is limited to availability.

Mitigation

The fix

Patches have been provided in the Linux kernel stable series [1][2][3]. The fix adds a kfree() for the ctx->domainname before cifs_construct_tcon() returns, ensuring the allocated memory is properly released. Users and administrators should apply the latest kernel updates from their distribution. A workaround is to avoid using the domain= option in conjunction with multiuser and cifscreds, or to avoid using multiuser CIFS mounts altogether until patched.