CVE-2026-23205
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2026-02-14

Last updated on: 2026-03-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs The error message is as follows: ============================================================================= BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Object 0x00000000d47521be @offset=14336 ... WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577 ... Call Trace: <TASK> kmem_cache_destroy+0x94/0x190 cifs_destroy_request_bufs+0x3e/0x50 [cifs] cleanup_module+0x4e/0x540 [cifs] __se_sys_delete_module+0x278/0x400 __x64_sys_delete_module+0x5f/0x70 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x89/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-14
Last Modified
2026-03-18
Generated
2026-06-16
AI Q&A
2026-02-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23205
EUVD
EUVD-2026-5840
Affected Vendors & Products
Showing 12 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.1.141 (inc) to 6.1.163 (exc)
linux linux_kernel From 6.12.31 (inc) to 6.12.70 (exc)
linux linux_kernel From 6.14.9 (inc) to 6.18.10 (exc)
linux linux_kernel From 6.6.93 (inc) to 6.6.124 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in the Linux kernel's SMB client implementation, specifically in the smb2_open_file() function. It occurs when using the CIFS protocol to mount a read-only exported directory from a server, perform file operations, unmount the directory, and then remove the CIFS kernel module. During this process, some memory objects are not properly freed, leading to leftover objects in the kernel's memory cache.

The issue manifests as warnings about objects remaining in the slab cache during module removal, indicating that the kernel's memory management routines did not clean up all allocated resources related to CIFS requests.

Impact Analysis

This memory leak can cause increased memory usage in the kernel over time when mounting and unmounting CIFS shares, potentially leading to resource exhaustion or degraded system performance. It may also cause warnings or errors during module removal, which could affect system stability or complicate debugging.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by reproducing the conditions that trigger the memory leak in the smb2_open_file() function of the Linux kernel's CIFS client.

  • Mount a read-only exported directory from the server using: mount -t cifs //${server_ip}/export /mnt
  • Write data to a file on the mounted directory using: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
  • Unmount the mounted directory: umount /mnt
  • Remove the CIFS kernel module: modprobe -r cifs

If the vulnerability is present, the kernel logs will show error messages such as "BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()" and warnings related to slab cache objects still existing during module removal.

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart