CVE-2026-98172: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix smbdconnection leak on cifsgettcpsession() error
When an RDMA connection is successfully established via smbdgetconnection() but cifsgettcpsession() later fails (e.g. kthreadcreate() returns an error), the error path frees tcpses without first destroying the smbdconnection.
Fix this by calling smbddestroy() in the outerr cleanup path before kfree(tcpses). smbddestroy() safely handles the case where smbdconn is NULL, so it can be called unconditionally.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.8-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the out_err cleanup path, call smbd_destroy() before kfree(tcp_ses); smbd_destroy() may be called unconditionally because it safely handles a NULL smbd_conn.
Event History
Frequently Asked Questions
Under what conditions can this leak occur?
The leak occurs when an SMB Direct (RDMA) connection has been established by smbd_get_connection(), but cifs_get_tcp_session() subsequently fails. The description gives failure to create a kernel thread with kthread_create() as an example.
What resource is leaked and what does the fix change?
The affected error path can free the TCP session object without destroying its associated smbd_connection. The fix invokes smbd_destroy() before freeing the TCP session object, releasing the RDMA connection; it is safe even when no smbd_connection exists.
How can I determine whether my kernel includes the fix?
Check whether your kernel source or vendor patch set includes one of the referenced stable commits: 3164402c58940ff58a3cecdb026405f07b0253af, e3344bb0ff5ec8a276f42239e140f5442841ef23, or 5c908e49d349266dff0c86dda6a05df0ff19b824.