CVE-2025-71151: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71151 is a memory leak and information disclosure vulnerability in the Linux kernel's CIFS (Common Internet File System) implementation, specifically in the smb3_reconfigure() function. When smb3_sync_session_ctx_passwords() fails, the function returns without freeing or erasing the newly allocated new_password and new_password2 buffers, leaving sensitive credential data in kernel memory. The vulnerability was published on January 23, 2026, and affects Linux kernel versions 6.6.64–6.6.119, 6.11.11–6.11.x, 6.12.2–6.12.63, 6.13–6.18.2, and 6.19-rc1/rc2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): when an error occurs in smb3_reconfigure() during a call to smb3_sync_session_ctx_passwords(), the function exits the error path without invoking kfree_sensitive() on the new_password and new_password2 buffers that were previously allocated. Because kfree_sensitive() both frees and zeroes the memory, omitting this call means plaintext SMB/CIFS authentication credentials may persist in kernel memory after the error condition. Exploitation requires local access with low privileges, as an attacker would need to trigger the reconfiguration error path and then leverage a separate memory disclosure primitive to read the residual credential data (Red Hat Advisory, Feedly).

Successful exploitation can result in two distinct impacts: a memory leak that could contribute to kernel memory exhaustion if the vulnerable code path is triggered repeatedly, and an information disclosure risk where plaintext CIFS/SMB authentication passwords persist in kernel memory and may be accessible to privileged attackers or via memory disclosure techniques. The confidentiality impact is rated High, while integrity and availability are unaffected. Systems using CIFS/SMB network file sharing are most at risk, as exposed credentials could enable lateral movement to network shares or other systems authenticated with the same credentials (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the attack surface to users who can already execute code on the affected system (Feedly, Red Hat Advisory).

Update the Linux kernel to a patched version: 6.6.120 or later (for the 6.6.x branch), 6.12.64 or later (for the 6.12.x branch), or 6.18.3 or later (for 6.13+ branches). Patches are available in the stable kernel trees via four commits (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3, kernel.org patch 4). Red Hat has also issued a security advisory and Bugzilla entry for affected RHEL systems. No configuration-based workaround is available; patching is the only remediation (Red Hat Advisory, Red Hat Bugzilla).