CVE-2025-71150

Vulnerability

Overview

CVE-2025-71150 is a reference count leak vulnerability in the ksmbd subsystem of the Linux kernel. The issue arises during session lookup: when a session is found but its state is not SMB2_SESSION_VALID, the code incorrectly treats this as no valid session being found, but fails to decrement the reference count that was acquired during the lookup. This omission causes a reference count leak, meaning the session object's reference counter is not properly balanced.

Exploitation

An attacker who can initiate SMB2 session requests to a system running ksmbd could trigger this code path. The attack requires the ability to cause a session lookup that returns a session in an invalid state. No special privileges beyond network access to the SMB service are needed. The vulnerability is in the session lookup logic, which is reachable from unauthenticated or partially authenticated states.

Impact

Repeatedly triggering this leak could exhaust kernel memory or other resources tied to the session objects, potentially leading to a denial-of-service (DoS) condition. The CVSS v3 base score of 5.5.5 (Medium) reflects the availability impact, though the attack complexity is low and no authentication is required.

Mitigation

The fix, which adds an explicit call to ksmbd_user_session_put to release the reference, has been applied to the Linux kernel stable tree. Patches are available in commits [1], [2], [3], and [4]. Users should update their kernel to include the fix. No workaround is documented.