CVE-2025-40285

smb/server: fix possible refcount leak in smb2_sess_setup()

HIGH

7.5

CVSS Score

Published: December 6, 2025 at 09:51 PM UTC

Updated: October 15, 2026 at 07:10 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.4%

Description

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible refcount leak in smb2_sess_setup() Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

90%

5.15.176 ≤ v < 5.166.1.121 ≤ v < 6.1.1596.12.6 ≤ v < 6.12.596.6.67 ≤ v < 6.6.1172107ab40629aeabbec369cf34b8cf0f288c3eb1b37a0e2b362b3150317fb6e2139de67b1e29ae5ff450a844c045ff0895d41b05a1cbe8febd1acfcfd5.15.176 6.1.121 6.12.6 6.13 6.6.67a39e31e22a535d47b14656a7d6a893c7f6cf758cb95629435b84b9ecc0c765995204a4d8a913ed52

Vendor states this is fixed in 379510a815cb2e64eb0a379cb62295d6ade65df0 (fixed)

Vendor states this is fixed in 6fc935f798d44a8eb8a5e6659198399fbf57b981 (fixed)

Vendor states this is fixed in d37b2c81c83d6c0d5ca582f4fe73c672983f9e0d (fixed)

Vendor states this is fixed in dcc51dfe6ff26b52cac106865a172ac982d78401 (fixed)

Vendor states this is fixed in e671f9bb97805771380c98de944e2ceab6949188 (fixed)

Affected range stops below 5.16, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.1.159 (unaffected)

Vendor states this is fixed in 6.12.59 (unaffected)

Vendor states this is fixed in 6.13 (unaffected)

Vendor states this is fixed in 6.17.9 (unaffected)

Vendor states this is fixed in 6.18 (unaffected)

Vendor states this is fixed in 6.6.117 (unaffected)