In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix refcount leak when invalid session is found on session lookup

When a session is found but its state is not SMB2_SESSION_VALID, It
indicates that no valid session was found, but it is missing to decrement
the reference count acquired by the session lookup, which results in
a reference count leak. This patch fixes the issue by explicitly calling
ksmbd_user_session_put to release the reference to the session.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
37a0e2b362b3150317fb6e2139de67b1e29ae5ff affected
< 0fb87b28cafae71e9c8248432cc3a6a1fd759efc
450a844c045ff0895d41b05a1cbe8febd1acfcfd affected
< e54fb2a4772545701766cba08aab20de5eace8cd
a39e31e22a535d47b14656a7d6a893c7f6cf758c affected
< 02e06785e85b4bd86ef3d23b7c8d87acc76773d5
b95629435b84b9ecc0c765995204a4d8a913ed52 affected
< 8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7
b95629435b84b9ecc0c765995204a4d8a913ed52 affected
< cafb57f7bdd57abba87725eb4e82bbdca4959644
2107ab40629aeabbec369cf34b8cf0f288c3eb1b affected
—
Linux Linux affected
Version Status Constraints
6.13 affected
—
0 unaffected
< 6.13
6.1.160 unaffected
≤ 6.1.*
6.6.120 unaffected
≤ 6.6.*
6.12.64 unaffected
≤ 6.12.*
6.18.3 unaffected
≤ 6.18.*
6.19 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4476-1 linux-6.1 security update
Debian DSA Debian DSA DSA-6126-1 linux security update
Debian DSA Debian DSA DSA-6127-1 linux security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/02e06785e85b4bd86ef3d23b7c8d87acc76773d5 cve-icon cve-icon
https://git.kernel.org/stable/c/0fb87b28cafae71e9c8248432cc3a6a1fd759efc cve-icon cve-icon
https://git.kernel.org/stable/c/8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7 cve-icon cve-icon
https://git.kernel.org/stable/c/cafb57f7bdd57abba87725eb4e82bbdca4959644 cve-icon cve-icon
https://git.kernel.org/stable/c/e54fb2a4772545701766cba08aab20de5eace8cd cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026012328-CVE-2025-71150-1b7c@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-71150 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-71150 cve-icon
History

Thu, 26 Feb 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-Other
CPEs cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*

Sat, 24 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Fri, 23 Jan 2026 14:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it is missing to decrement the reference count acquired by the session lookup, which results in a reference count leak. This patch fixes the issue by explicitly calling ksmbd_user_session_put to release the reference to the session.
Title ksmbd: Fix refcount leak when invalid session is found on session lookup
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-02-09T08:35:47.327Z

Reserved: 2026-01-13T15:30:19.662Z

Link: CVE-2025-71150

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-01-23T15:16:05.773

Modified: 2026-02-26T20:28:42.167

Link: CVE-2025-71150

cve-icon Redhat

Severity : Low

Publid Date: 2026-01-23T00:00:00Z

Links: CVE-2025-71150 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses