CVE-2025-71150: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71150 is a reference count leak vulnerability in the Linux kernel's ksmbd (kernel SMB server) module during session lookup. When a session is found but its state is not SMB2_SESSION_VALID, the code fails to decrement the reference count acquired during the lookup, resulting in a kernel memory leak. The vulnerability was disclosed on January 23, 2026, and affects multiple Linux kernel stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is a missing call to ksmbd_user_session_put() in the session lookup code path when an invalid (non-SMB2_SESSION_VALID) session is encountered, classified under CWE-Other (improper resource management). The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction. A local attacker can repeatedly trigger the invalid session lookup path — for example, by sending SMB2 requests with session IDs that map to sessions in an invalid state — causing the kernel to accumulate unreleased session references over time. No public proof-of-concept exploit code has been identified (Feedly, kernel.org patches).

Successful exploitation causes gradual kernel memory exhaustion due to unreleased session reference counts in the ksmbd module. There is no confidentiality or integrity impact; the sole consequence is availability degradation. Repeated exploitation by a local low-privileged attacker could lead to denial of service through resource exhaustion and potential system crashes (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing ksmbd-related warnings or errors, particularly around session state validation or memory allocation failures.
• System Behavior: Gradual increase in kernel memory usage (observable via /proc/meminfo or tools like smem) without a corresponding increase in workload, potentially indicating a reference count leak.
• Process: Unusual or repeated SMB2 session setup attempts from local processes interacting with the ksmbd service, especially with session IDs that do not correspond to valid sessions.

Patches have been released across multiple Linux kernel stable branches. Users should upgrade to one of the following fixed versions: 5.16 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, or 6.18.3 or later. Patch commits are available at kernel.org (hashes: 02e06785, 0fb87b28, 8cabcb4d, cafb57f7, e54fb2a4). As a workaround where patching is not immediately possible, restrict local user access to systems running ksmbd and consider disabling the ksmbd service if SMB server functionality is not required (Feedly, kernel.org patches).