CVE-2026-90175: smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
In the Linux kernel, the following vulnerability has been resolved:
smb: server: fix leak of ksmbdipcloginrequestext() returned buffer
Free it unconditionally after ksmbdallocuser() calls.
kmemleak splat: unreferenced object 0xffff888103b83540 (size 192): comm "pool-0", pid 16970, jiffies 4377290937 hex dump (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 408ccc66): kvmallocnodenoprof+0x730/0x920 handlegenericevent+0xec/0x1a0 [ksmbd] genlfamilyrcvmsgdoit+0xe0/0x130 genlrcvmsg+0x181/0x290 netlinkrcvskb+0x4f/0x100 genlrcv+0x28/0x40 netlinkunicast+0x1e6/0x2c0 netlinksendmsg+0x20a/0x450 syssendmsg+0x2e8/0x310 syssendmsg+0x78/0xc0 syssendmsg+0x63/0xc0 dosyscall64+0xa1/0x670 entrySYSCALL64afterhwframe+0x76/0x7e
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel SMB server component (ksmbd) are the relevant population. The report specifically shows the leak occurring in ksmbd code while processing a generic netlink message.
What evidence can indicate that a system is affected?
A kmemleak report for an unreferenced 192-byte allocation, with a backtrace including __kvmalloc_node_noprof, handle_generic_event, and ksmbd generic-netlink handling, is evidence consistent with this issue. The reported task name was "pool-0".
What is the remediation described by the fix?
The fix frees the buffer returned by ksmbd_ipc_login_request_ext() unconditionally after ksmbd_alloc_user() is called.