CVE-2026-23205: smb/client: fix memory leak in smb2_open_file()
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix memory leak in smb2openfile()
Reproducer:
1. server: directories are exported read-only 2. client: mount -t cifs //${serverip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs
The error message is as follows:
============================================================================= BUG cifssmallrq (Not tainted): Objects remaining on kmemcacheshutdown() -----------------------------------------------------------------------------
Object 0x00000000d47521be @offset=14336 ... WARNING: mm/slub.c:1251 at kmemcacheshutdown+0x34e/0x440, CPU#0: modprobe/1577 ... Call Trace: <TASK> kmemcachedestroy+0x94/0x190 cifsdestroyrequestbufs+0x3e/0x50 [cifs] cleanupmodule+0x4e/0x540 [cifs] sesysdeletemodule+0x278/0x400 x64sysdeletemodule+0x5f/0x70 x64syscall+0x2299/0x2ff0 dosyscall64+0x89/0x350 entrySYSCALL64afterhwframe+0x76/0x7e ... kmemcachedestroy cifssmallrq: Slab cache still has objects when called from cifsdestroyrequestbufs+0x3e/0x50 [cifs] WARNING: mm/slabcommon.c:532 at kmemcachedestroy+0x16b/0x190, CPU#0: modprobe/1577
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23205?
CVE-2026-23205 is rated as a medium severity vulnerability due to its potential impact on system performance through memory leaks.
How does CVE-2026-23205 affect the Linux kernel?
CVE-2026-23205 affects the Linux kernel by introducing a memory leak during the file opening process in the SMB2 client.
How do I fix CVE-2026-23205?
To fix CVE-2026-23205, you should update your Linux kernel to the latest version where the vulnerability has been patched.
Is CVE-2026-23205 exploitable remotely?
Yes, CVE-2026-23205 can be exploited remotely if a client connects to an affected SMB server.
What versions of the Linux kernel are affected by CVE-2026-23205?
CVE-2026-23205 impacts various versions of the Linux kernel, particularly those using the SMB2 protocol in client configurations.