CVE-2025-71220: smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
In the Linux kernel, the following vulnerability has been resolved:
smb/server: call ksmbdsessionrpcclose() on error path in createsmb2pipe()
When ksmbdiovpinrsp() fails, we should call ksmbdsessionrpcclose().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In create_smb2_pipe(), call ksmbd_session_rpc_close() when ksmbd_iov_pin_rsp() fails.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71220?
CVE-2025-71220 is classified as a medium severity vulnerability.
What systems are affected by CVE-2025-71220?
CVE-2025-71220 affects the Linux kernel, specifically in its SMB server functionality.
How do I fix CVE-2025-71220?
To mitigate CVE-2025-71220, update your Linux kernel to the latest patched version provided by your distribution.
What are the potential impacts of CVE-2025-71220?
Exploitation of CVE-2025-71220 may lead to denial of service or unauthorized access through improper handling of SMB sessions.
When was CVE-2025-71220 disclosed?
CVE-2025-71220 was disclosed in 2025, presenting vulnerabilities related to error handling in SMB2 pipe creation.