CVE-2025-71204

smb/server: fix refcount leak in parse_durable_handle_context()

State: Published
Severity: 7.5 High
Published: Feb 14, 2026
Updated: Aug 5, 2026
Reserved: Jan 31, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix refcount leak in parse_durable_handle_context()

When the command is a replay operation and -ENOEXEC is returned, the refcount of ksmbd_file must be released.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8df4bcdb0a4232192b2445256c39b787d58ef14d to before 07df5ff4f6490a5c96715b7c562e0b2908422e04Affected c8efcc786146a951091588e5fa7e3c754850cb3c to before 8a15107c4c031fb19737bf2eb4000f847f1d5e4cAffected c8efcc786146a951091588e5fa7e3c754850cb3c to before 70dd3513ed6ac8c6cab23f72c5b19f44ca89de9dAffected c8efcc786146a951091588e5fa7e3c754850cb3c to before 3296c3012a9d9a27e81e34910384e55a6ff3cff0Affected 6.6.32 to before 6.6.124Affected
LinuxLinux	6.9Affected before 6.9Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

8df4bcdb0a4232192b2445256c39b787d58ef14d to before 07df5ff4f6490a5c96715b7c562e0b2908422e04Affected
c8efcc786146a951091588e5fa7e3c754850cb3c to before 8a15107c4c031fb19737bf2eb4000f847f1d5e4cAffected
c8efcc786146a951091588e5fa7e3c754850cb3c to before 70dd3513ed6ac8c6cab23f72c5b19f44ca89de9dAffected
c8efcc786146a951091588e5fa7e3c754850cb3c to before 3296c3012a9d9a27e81e34910384e55a6ff3cff0Affected
6.6.32 to before 6.6.124Affected

LinuxLinux

6.9Affected
before 6.9Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.