{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-71204","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-01-31T11:36:51.194Z","datePublished":"2026-02-14T16:27:03.252Z","dateUpdated":"2026-08-05T12:12:32.645Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:12:32.645Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix refcount leak in parse_durable_handle_context()\n\nWhen the command is a replay operation and -ENOEXEC is returned,\nthe refcount of ksmbd_file must be released."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd processes SMB2 CREATE requests received remotely over TCP, normally port 445.\nAC:L - The attacker controls the ClientGuid, CreateGuid, and replay flag and can deterministically create a matching handle before sending duplicate DH2Q requests; no race or uncontrollable timing is required.\nPR:N - Although SMB2 CREATE requires a valid session and tree connection, a credential-free guest session on a guest-enabled disk share satisfies these gates in a reasonable deployment.\nUI:N - Exploitation requires only attacker-generated SMB requests and no action by another user.\nS:U - The vulnerability and resulting resource exhaustion remain within the host kernel and ksmbd security authority without crossing a VM, sandbox, or IOMMU boundary.\nC:N - The affected path only leaks a reference to an existing ksmbd_file and performs no out-of-bounds read, use-after-free, or information disclosure.\nI:N - The leaked reference prevents cleanup but provides no memory-write primitive or unauthorized modification; the separate replay-flag use-after-free is not caused by this missing put.\nA:H - Repeated requests can permanently pin global file-table entries, underlying open files, oplocks, and locks while preventing restoration of ksmbd's global file limit. Exhausting that limit denies subsequent SMB file opens across all shares and clients."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"],"versions":[{"version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","lessThan":"07df5ff4f6490a5c96715b7c562e0b2908422e04","status":"affected","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","lessThan":"8a15107c4c031fb19737bf2eb4000f847f1d5e4c","status":"affected","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","lessThan":"70dd3513ed6ac8c6cab23f72c5b19f44ca89de9d","status":"affected","versionType":"git"},{"version":"c8efcc786146a951091588e5fa7e3c754850cb3c","lessThan":"3296c3012a9d9a27e81e34910384e55a6ff3cff0","status":"affected","versionType":"git"},{"version":"6.6.32","lessThan":"6.6.124","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"],"versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","status":"unaffected","versionType":"semver"},{"version":"6.6.124","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.70","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.10","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.32","versionEndExcluding":"6.6.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.12.70"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.18.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.19"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/07df5ff4f6490a5c96715b7c562e0b2908422e04"},{"url":"https://git.kernel.org/stable/c/8a15107c4c031fb19737bf2eb4000f847f1d5e4c"},{"url":"https://git.kernel.org/stable/c/70dd3513ed6ac8c6cab23f72c5b19f44ca89de9d"},{"url":"https://git.kernel.org/stable/c/3296c3012a9d9a27e81e34910384e55a6ff3cff0"}],"title":"smb/server: fix refcount leak in parse_durable_handle_context()","x_generator":{"engine":"bippy-1.2.0"}}}}