CVE-2026-23228
Modified Modified - Updated After Analysis

Reference Leak Vulnerability in Linux ksmbd_tcp_new_connection

Publication date: 2026-02-18

Last updated on: 2026-06-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-18
Last Modified
2026-06-02
Generated
2026-07-06
AI Q&A
2026-02-18
EPSS Evaluated
2026-07-05
NVD
CVE-2026-23228

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.2
linux linux_kernel 6.2
linux linux_kernel 6.2
linux linux_kernel 6.2
linux linux_kernel From 6.19 (inc) to 6.19.1 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.72 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.11 (exc)
linux linux_kernel From 5.15.91 (inc) to 5.15.201 (exc)
linux linux_kernel From 6.1.9 (inc) to 6.1.164 (exc)
linux linux_kernel From 6.2.1 (inc) to 6.6.125 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Impact Analysis

The impact of this vulnerability is a resource leak in the SMB server component of the Linux kernel. Specifically, the active_num_conn counter can be incremented but not decremented properly when a connection fails to start, leading to an inaccurate count of active connections.

Over time, this could potentially lead to resource management issues, such as exhaustion of connection tracking resources or incorrect server behavior due to the miscount of active connections.

Executive Summary

This vulnerability exists in the Linux kernel's SMB server component. Specifically, when a new TCP connection is created in the ksmbd_tcp_new_connection() function, if the kthread_run() call fails, the transport is freed using free_transport(). However, free_transport() does not decrement the active_num_conn counter, which tracks the number of active connections. This causes a leak in the active_num_conn counter.

The fix replaces the call to free_transport() with ksmbd_tcp_disconnect(), which properly decrements the active_num_conn counter, preventing the leak.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart