CVE-2025-71150
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2026-01-23

Last updated on: 2026-04-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it is missing to decrement the reference count acquired by the session lookup, which results in a reference count leak. This patch fixes the issue by explicitly calling ksmbd_user_session_put to release the reference to the session.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-23
Last Modified
2026-04-18
Generated
2026-06-16
AI Q&A
2026-01-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-71150
Affected Vendors & Products
Showing 12 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.13
linux linux_kernel 6.13
linux linux_kernel 6.13
linux linux_kernel 6.13
linux linux_kernel 6.13
linux linux_kernel 6.13
linux linux_kernel 6.19
linux linux_kernel From 5.15.176 (inc) to 5.16 (exc)
linux linux_kernel From 6.1.121 (inc) to 6.1.160 (exc)
linux linux_kernel From 6.12.6 (inc) to 6.12.64 (exc)
linux linux_kernel From 6.13.1 (inc) to 6.18.3 (exc)
linux linux_kernel From 6.6.67 (inc) to 6.6.120 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a reference count leak in the Linux kernel's ksmbd component. When a session lookup finds a session that is not in a valid state (not SMB2_SESSION_VALID), the reference count acquired during the lookup is not decremented properly. This causes a reference count leak, meaning resources are not released as they should be. The fix involves explicitly releasing the reference to the session to prevent the leak.

Impact Analysis

The reference count leak can lead to resource exhaustion over time, potentially causing degraded system performance or instability in the ksmbd service or the Linux kernel. This could affect the reliability of SMB services on the system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart