Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-71150

ksmbd: Fix refcount leak when invalid session is found on session lookup

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it is missing to decrement the reference count acquired by the session lookup, which results in a reference count leak. This patch fixes the issue by explicitly calling ksmbd_user_session_put to release the reference to the session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 2107ab40629aeabbec369cf34b8cf0f288c3eb1b to < 11fe566b442e3bc2774191740fd377739a87a1c0affected
  • 37a0e2b362b3150317fb6e2139de67b1e29ae5ff to < 0fb87b28cafae71e9c8248432cc3a6a1fd759efcaffected
  • 450a844c045ff0895d41b05a1cbe8febd1acfcfd to < e54fb2a4772545701766cba08aab20de5eace8cdaffected
  • a39e31e22a535d47b14656a7d6a893c7f6cf758c to < 02e06785e85b4bd86ef3d23b7c8d87acc76773d5affected
  • b95629435b84b9ecc0c765995204a4d8a913ed52 to < 8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7affected
  • b95629435b84b9ecc0c765995204a4d8a913ed52 to < cafb57f7bdd57abba87725eb4e82bbdca4959644affected
  • 5.15.176 to < 5.15.203affected
  • 6.1.121 to < 6.1.160affected
  • 6.6.67 to < 6.6.120affected
  • 6.12.6 to < 6.12.64affected

Linux Linux

Default version status: affected

  • 6.13affected
  • 0 to < 6.13unaffected
  • 5.15.203 to ≤ 5.15.*unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.64 to ≤ 6.12.*unaffected
  • 6.18.3 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References