CVE-2025-71150

ksmbd: Fix refcount leak when invalid session is found on session lookup

State: Published
Severity: 7.5 High
Published: Jan 23, 2026
Updated: Aug 5, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix refcount leak when invalid session is found on session lookup

When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it is missing to decrement the reference count acquired by the session lookup, which results in a reference count leak. This patch fixes the issue by explicitly calling ksmbd_user_session_put to release the reference to the session.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2107ab40629aeabbec369cf34b8cf0f288c3eb1b to before 11fe566b442e3bc2774191740fd377739a87a1c0Affected 37a0e2b362b3150317fb6e2139de67b1e29ae5ff to before 0fb87b28cafae71e9c8248432cc3a6a1fd759efcAffected 450a844c045ff0895d41b05a1cbe8febd1acfcfd to before e54fb2a4772545701766cba08aab20de5eace8cdAffected a39e31e22a535d47b14656a7d6a893c7f6cf758c to before 02e06785e85b4bd86ef3d23b7c8d87acc76773d5Affected b95629435b84b9ecc0c765995204a4d8a913ed52 to before 8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7Affected b95629435b84b9ecc0c765995204a4d8a913ed52 to before cafb57f7bdd57abba87725eb4e82bbdca4959644Affected 5.15.176 to before 5.15.203Affected 6.1.121 to before 6.1.160Affected 6.6.67 to before 6.6.120Affected 6.12.6 to before 6.12.64Affected
LinuxLinux	6.13Affected before 6.13Not affected 5.15.203 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

2107ab40629aeabbec369cf34b8cf0f288c3eb1b to before 11fe566b442e3bc2774191740fd377739a87a1c0Affected
37a0e2b362b3150317fb6e2139de67b1e29ae5ff to before 0fb87b28cafae71e9c8248432cc3a6a1fd759efcAffected
450a844c045ff0895d41b05a1cbe8febd1acfcfd to before e54fb2a4772545701766cba08aab20de5eace8cdAffected
a39e31e22a535d47b14656a7d6a893c7f6cf758c to before 02e06785e85b4bd86ef3d23b7c8d87acc76773d5Affected
b95629435b84b9ecc0c765995204a4d8a913ed52 to before 8cabcb4dd3dc85dd83a37d26efcc59a66a4074d7Affected
b95629435b84b9ecc0c765995204a4d8a913ed52 to before cafb57f7bdd57abba87725eb4e82bbdca4959644Affected
5.15.176 to before 5.15.203Affected
6.1.121 to before 6.1.160Affected
6.6.67 to before 6.6.120Affected
6.12.6 to before 6.12.64Affected

LinuxLinux

6.13Affected
before 6.13Not affected
5.15.203 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.