CVE-2026-23205

smb/client: fix memory leak in smb2_open_file()

Published Feb 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix memory leak in smb2_open_file()

Reproducer:

1. server: directories are exported read-only
2. client: mount -t cifs //${server_ip}/export /mnt
3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
4. client: umount /mnt
5. client: sleep 1
6. client: modprobe -r cifs

The error message is as follows:

=============================================================================
BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
-----------------------------------------------------------------------------

Object 0x00000000d47521be @offset=14336
...
WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577
...
Call Trace:
<TASK>
kmem_cache_destroy+0x94/0x190
cifs_destroy_request_bufs+0x3e/0x50 [cifs]
cleanup_module+0x4e/0x540 [cifs]
__se_sys_delete_module+0x278/0x400
__x64_sys_delete_module+0x5f/0x70
x64_sys_call+0x2299/0x2ff0
do_syscall_64+0x89/0x350
entry_SYSCALL_64_after_hwframe+0x76/0x7e
...
kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]
WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577

Analysis

Technical impact

A memory leak was detected in the Linux kernel SMB2 client within the smb2_open_file() function, causing the CIFS module to retain cached objects when unloaded. The leak can cause gradual kernel memory depletion, leading to service degradation, crashes, or a panic. This issue is classified as CWE‑401 and has a CVSS score of 5.5, indicating moderate impact. It manifests during typical SMB operations such as mounting a read‑only share, creating a file, unmounting, and removing the module.

Affected Systems

All Linux kernel builds that include the CIFS (CIFS client) module are affected, notably the 6.19 release candidate series up to RC8 and any downstream distributions shipping these kernels. The fix is incorporated in later kernel releases; users should apply updates accordingly.

Risk and Exploitability

The CVSS rating of 5.5 reflects moderate severity, while EPSS is less than 1 % and the vulnerability is not in the CISA KEV catalog, suggesting low exploitation probability. An attacker who can mount an SMB share, perform file operations, and unload the module can trigger the leak, potentially leading to denial of service over time, but not providing arbitrary code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`17e53a15e64b65623b8f2b1185d27d7b1cbf69ab`	affected	< 743f70406264348c0830f38409eb6c40a42fb2db
`18066188eb90cc0c798f3370a8078a79ddb73f70`	affected	< 3a6d6b332f92990958602c1e35ce0173e2dd62e9
`6ebb9d54eccc8026b386e76eff69364d33373da5`	affected	< b64e3b5d8d759dd4333992e4ba4dadf9359952c8
`e255612b5ed9f179abe8196df7c2ba09dd227900`	affected	< 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5
`e255612b5ed9f179abe8196df7c2ba09dd227900`	affected	< e3a43633023e3cacaca60d4b8972d084a2b06236
`bcd15f06c7e8904116cfb06526bcc189b86aff85`	affected	—
`6.1.141`	affected	< 6.1.163
`6.6.93`	affected	< 6.6.124
`6.12.31`	affected	< 6.12.70
`6.14.9`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.1.163`	unaffected	≤ 6.1.*
`6.6.124`	unaffected	≤ 6.6.*
`6.12.70`	unaffected	≤ 6.12.*
`6.18.10`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc8::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[17e53a15e64b65623b8f2b1185d27d7b1cbf69ab,743f70406264348c0830f38409eb6c40a42fb2db)`	affected	code_commit	—
`[18066188eb90cc0c798f3370a8078a79ddb73f70,3a6d6b332f92990958602c1e35ce0173e2dd62e9)`	affected	code_commit	—
`[6ebb9d54eccc8026b386e76eff69364d33373da5,b64e3b5d8d759dd4333992e4ba4dadf9359952c8)`	affected	code_commit	—
`[e255612b5ed9f179abe8196df7c2ba09dd227900,9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5)`	affected	code_commit	—
`[e255612b5ed9f179abe8196df7c2ba09dd227900,e3a43633023e3cacaca60d4b8972d084a2b06236)`	affected	code_commit	—
`bcd15f06c7e8904116cfb06526bcc189b86aff85`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.1.163,6.2.0)`	unaffected	semver	—
`[6.6.124,6.7.0)`	unaffected	semver	—
`[6.12.70,6.13.0)`	unaffected	semver	—
`[6.18.10,6.19.0)`	unaffected	semver	—
`[6.19,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the smb2_open_file memory‑leak fix (e.g., later than 6.19‑RC8).
If an update cannot be applied immediately, disable or unload the cifs module when it is not needed to prevent the leak from accumulating.
Ensure that SMB client mounts are unmounted before removing the module and that the module can be safely removed without leaving active requests.

Generated by OpenCVE AI on April 17, 2026 at 19:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8278-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8289-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8296-1	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8296-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8278-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8289-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8393-1	Linux kernel (Azure FIPS) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.135% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3a6d6b332f92990958602c1e35ce0173e2dd62e9
https://git.kernel.org/stable/c/743f70406264348c0830f38409eb6c40a42fb2db
https://git.kernel.org/stable/c/9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5
https://git.kernel.org/stable/c/b64e3b5d8d759dd4333992e4ba4dadf9359952c8
https://git.kernel.org/stable/c/e3a43633023e3cacaca60d4b8972d084a2b06236
https://lore.kernel.org/linux-cve-announce/2026021438-CVE-2026-23205-a62a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23205
https://www.cve.org/CVERecord?id=CVE-2026-23205

History

Mar 18, 2026 5:15 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-401
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc7:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc8::::::

Feb 17, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021438-CVE-2026-23205-a62a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23205 https://www.cve.org/CVERecord?id=CVE-2026-23205
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Feb 14, 2026 4:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs The error message is as follows: ============================================================================= BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Object 0x00000000d47521be @offset=14336 ... WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577 ... Call Trace: <TASK> kmem_cache_destroy+0x94/0x190 cifs_destroy_request_bufs+0x3e/0x50 [cifs] cleanup_module+0x4e/0x540 [cifs] __se_sys_delete_module+0x278/0x400 __x64_sys_delete_module+0x5f/0x70 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x89/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577
Title		smb/client: fix memory leak in smb2_open_file()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3a6d6b332f92990958602c1e35ce0173e2dd62e9 https://git.kernel.org/stable/c/743f70406264348c0830f38409eb6c40a42fb2db https://git.kernel.org/stable/c/9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5 https://git.kernel.org/stable/c/b64e3b5d8d759dd4333992e4ba4dadf9359952c8 https://git.kernel.org/stable/c/e3a43633023e3cacaca60d4b8972d084a2b06236