Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-71151

cifs: Fix memory and information leak in smb3_reconfigure()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the newly allocated new_password and new_password2. This causes both a memory leak and a potential information leak. Fix this by calling kfree_sensitive() on both password buffers before returning in this error case.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 880a661e67648a3ffe85405e8de5f50650a3c0b2 to < bc390b2737205163e48cc1655f6a0c8cd55b02fcaffected
  • 0e4145774c016530bf99afb3675a1a0593c35642 to < 5679cc90bb5415801fa29041da0319d9e15d295daffected
  • 0f0e357902957fba28ed31bde0d6921c6bd1485d to < bb82aaee16907dc4d0b9b0ca7953ceb3edc328c6affected
  • 0f0e357902957fba28ed31bde0d6921c6bd1485d to < cb6d5aa9c0f10074f1ad056c3e2278ad2cc7ec8daffected
  • 674ba43944dab8e8f87434e25d9d10c5152584bcaffected
  • 6.6.64 to < 6.6.120affected
  • 6.12.2 to < 6.12.64affected
  • 6.11.11 to < 6.12affected

Linux Linux

Default version status: affected

  • 6.13affected
  • 0 to < 6.13unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.64 to ≤ 6.12.*unaffected
  • 6.18.3 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References