CVE-2026-98162: smb/server: fix tree connection leak in smb2_tree_connect()
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix tree connection leak in smb2treeconnect()
See the procedure below:
smb2treeconnect ksmbdtreeconnconnect xastore(&sess->treeconns, treeconn->id, treeconn) ksmbdcounterinc(KSMBDCOUNTERTREECONNS) ksmbdsharetreeconninc(sc) ksmbdiovpinrsp // fail status.ret = KSMBDTREECONNSTATUSNOMEM // do not disconnect treeconn
Disconnect the new tree connection if ksmbdiovpinrsp() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disconnect the newly created tree connection when ksmbd_iov_pin_rsp() fails in smb2_tree_connect().
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when ksmbd_iov_pin_rsp() fails after a new SMB2 tree connection has been stored and its associated counters have been incremented. The failure path returns an out-of-memory tree-connection status without disconnecting that new tree connection.
Which systems are exposed?
Systems using the Linux kernel SMB server code path that handles SMB2 tree connections are affected. The provided data does not identify specific kernel versions, configurations, or distributions.
What is the immediate mitigation if the fix cannot be deployed?
No workaround is provided in the available data. The documented corrective action is to disconnect the newly created tree connection when ksmbd_iov_pin_rsp() fails.