CVE-2026-23205

smb/client: fix memory leak in smb2_open_file()

State: Published
Severity: Not scored
Published: Feb 14, 2026
Updated: May 23, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix memory leak in smb2_open_file()

Reproducer:

1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs

The error message is as follows:

============================================================================= BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() -----------------------------------------------------------------------------

Object 0x00000000d47521be @offset=14336 ... WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577 ... Call Trace: <TASK> kmem_cache_destroy+0x94/0x190 cifs_destroy_request_bufs+0x3e/0x50 [cifs] cleanup_module+0x4e/0x540 [cifs] __se_sys_delete_module+0x278/0x400 __x64_sys_delete_module+0x5f/0x70 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x89/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	17e53a15e64b65623b8f2b1185d27d7b1cbf69ab to before 743f70406264348c0830f38409eb6c40a42fb2dbAffected 18066188eb90cc0c798f3370a8078a79ddb73f70 to before 3a6d6b332f92990958602c1e35ce0173e2dd62e9Affected 6ebb9d54eccc8026b386e76eff69364d33373da5 to before b64e3b5d8d759dd4333992e4ba4dadf9359952c8Affected e255612b5ed9f179abe8196df7c2ba09dd227900 to before 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5Affected e255612b5ed9f179abe8196df7c2ba09dd227900 to before e3a43633023e3cacaca60d4b8972d084a2b06236Affected bcd15f06c7e8904116cfb06526bcc189b86aff85Affected 6.1.141 to before 6.1.163Affected 6.6.93 to before 6.6.124Affected 6.12.31 to before 6.12.70Affected 6.14.9 to before 6.15Affected
LinuxLinux	6.15Affected before 6.15Not affected 6.1.163 through 6.1.Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

17e53a15e64b65623b8f2b1185d27d7b1cbf69ab to before 743f70406264348c0830f38409eb6c40a42fb2dbAffected
18066188eb90cc0c798f3370a8078a79ddb73f70 to before 3a6d6b332f92990958602c1e35ce0173e2dd62e9Affected
6ebb9d54eccc8026b386e76eff69364d33373da5 to before b64e3b5d8d759dd4333992e4ba4dadf9359952c8Affected
e255612b5ed9f179abe8196df7c2ba09dd227900 to before 9ee608a64e37cea5b4b13e436c559dd0fb2ad1b5Affected
e255612b5ed9f179abe8196df7c2ba09dd227900 to before e3a43633023e3cacaca60d4b8972d084a2b06236Affected
bcd15f06c7e8904116cfb06526bcc189b86aff85Affected
6.1.141 to before 6.1.163Affected
6.6.93 to before 6.6.124Affected
6.12.31 to before 6.12.70Affected
6.14.9 to before 6.15Affected

LinuxLinux

6.15Affected
before 6.15Not affected
6.1.163 through 6.1.*Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.