CVE-2026-23228
Reference Leak Vulnerability in Linux ksmbd_tcp_new_connection
Publication date: 2026-02-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.2 |
| linux | linux_kernel | 6.2 |
| linux | linux_kernel | 6.2 |
| linux | linux_kernel | 6.2 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.1 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.72 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.11 (exc) |
| linux | linux_kernel | From 5.15.91 (inc) to 5.15.201 (exc) |
| linux | linux_kernel | From 6.1.9 (inc) to 6.1.164 (exc) |
| linux | linux_kernel | From 6.2.1 (inc) to 6.6.125 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SMB server component. Specifically, when a new TCP connection is created in the ksmbd_tcp_new_connection() function, if the kthread_run() call fails, the transport is freed using free_transport(). However, free_transport() does not decrement the active_num_conn counter, which tracks the number of active connections. This causes a leak in the active_num_conn counter.
The fix replaces the call to free_transport() with ksmbd_tcp_disconnect(), which properly decrements the active_num_conn counter, preventing the leak.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know
How can this vulnerability impact me? :
The impact of this vulnerability is a resource leak in the SMB server component of the Linux kernel. Specifically, the active_num_conn counter can be incremented but not decremented properly when a connection fails to start, leading to an inaccurate count of active connections.
Over time, this could potentially lead to resource management issues, such as exhaustion of connection tracking resources or incorrect server behavior due to the miscount of active connections.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know