{"id":"CVE-2025-71204","state":"PUBLISHED","title":"smb/server: fix refcount leak in parse_durable_handle_context()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix refcount leak in parse_durable_handle_context()\n\nWhen the command is a replay operation and -ENOEXEC is returned,\nthe refcount of ksmbd_file must be released.","publishedAt":"2026-02-14T16:27:03.252Z","updatedAt":"2026-08-05T12:12:32.645Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","status":"affected","lessThan":"07df5ff4f6490a5c96715b7c562e0b2908422e04","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","status":"affected","lessThan":"8a15107c4c031fb19737bf2eb4000f847f1d5e4c","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","status":"affected","lessThan":"70dd3513ed6ac8c6cab23f72c5b19f44ca89de9d","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","status":"affected","lessThan":"3296c3012a9d9a27e81e34910384e55a6ff3cff0","versionType":"git"},{"version":"6.6.32","status":"affected","lessThan":"6.6.124","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.9","versionType":"semver"},{"version":"6.6.124","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.70","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.10","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]}],"references":["https://git.kernel.org/stable/c/07df5ff4f6490a5c96715b7c562e0b2908422e04","https://git.kernel.org/stable/c/8a15107c4c031fb19737bf2eb4000f847f1d5e4c","https://git.kernel.org/stable/c/70dd3513ed6ac8c6cab23f72c5b19f44ca89de9d","https://git.kernel.org/stable/c/3296c3012a9d9a27e81e34910384e55a6ff3cff0"],"weaknesses":[],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/71xxx/CVE-2025-71204.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-71204","state":"PUBLISHED","datePublished":"2026-02-14T16:27:03.252Z","dateUpdated":"2026-08-05T12:12:32.645Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-31T11:36:51.194Z"},"containers":{"cna":{"title":"smb/server: fix refcount leak in parse_durable_handle_context()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix refcount leak in parse_durable_handle_context()\n\nWhen the command is a replay operation and -ENOEXEC is returned,\nthe refcount of ksmbd_file must be released."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","status":"affected","lessThan":"07df5ff4f6490a5c96715b7c562e0b2908422e04","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","status":"affected","lessThan":"8a15107c4c031fb19737bf2eb4000f847f1d5e4c","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","status":"affected","lessThan":"70dd3513ed6ac8c6cab23f72c5b19f44ca89de9d","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","status":"affected","lessThan":"3296c3012a9d9a27e81e34910384e55a6ff3cff0","versionType":"git"},{"version":"6.6.32","status":"affected","lessThan":"6.6.124","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.9","versionType":"semver"},{"version":"6.6.124","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.70","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.10","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/07df5ff4f6490a5c96715b7c562e0b2908422e04"},{"url":"https://git.kernel.org/stable/c/8a15107c4c031fb19737bf2eb4000f847f1d5e4c"},{"url":"https://git.kernel.org/stable/c/70dd3513ed6ac8c6cab23f72c5b19f44ca89de9d"},{"url":"https://git.kernel.org/stable/c/3296c3012a9d9a27e81e34910384e55a6ff3cff0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd processes SMB2 CREATE requests received remotely over TCP, normally port 445.\nAC:L - The attacker controls the ClientGuid, CreateGuid, and replay flag and can deterministically create a matching handle before sending duplicate DH2Q requests; no race or uncontrollable timing is required.\nPR:N - Although SMB2 CREATE requires a valid session and tree connection, a credential-free guest session on a guest-enabled disk share satisfies these gates in a reasonable deployment.\nUI:N - Exploitation requires only attacker-generated SMB requests and no action by another user.\nS:U - The vulnerability and resulting resource exhaustion remain within the host kernel and ksmbd security authority without crossing a VM, sandbox, or IOMMU boundary.\nC:N - The affected path only leaks a reference to an existing ksmbd_file and performs no out-of-bounds read, use-after-free, or information disclosure.\nI:N - The leaked reference prevents cleanup but provides no memory-write primitive or unauthorized modification; the separate replay-flag use-after-free is not caused by this missing put.\nA:H - Repeated requests can permanently pin global file-table entries, underlying open files, oplocks, and locks while preventing restoration of ksmbd's global file limit. Exhausting that limit denies subsequent SMB file opens across all shares and clients."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:12:32.645Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.32","versionEndExcluding":"6.6.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.12.70"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.18.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}