The Linux kernel contains a flaw in the ksmbd SMB server that accepts multiple successful SMB2 NEGOTIATE requests on a single connection before the SESSION_SETUP phase. Each additional negotiate request creates a new preauthentication information object, overwriting the previous one; only the last object is released when the connection ends. This results in a memory leak that can accumulate with repeated requests from an unauthenticated client, potentially exhausting kernel memory and causing denial of service, but it does not provide code execution capabilities.

All Linux systems running the Linux kernel with the ksmbd component are affected. The specific vulnerable kernel versions are not listed, so any kernel containing the fault before the distinguishing commit is at risk.

The flaw can be exploited over the SMB2 interface by an unauthenticated client sending repeated negotiation requests. The vulnerability has a CVSS score of 5.5 and an EPSS score of < 1%, and it is not listed in the CISA KEV catalog, indicating no known active exploitation. However, even without a proximal exploit, the repeated NEGOTIATE requests can trigger resource exhaustion. The fix serializes negotiation and rejects repeated NEGOTIATE requests to eliminate the leak.