CVE-2025-71153: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71153 is a memory leak vulnerability in the Linux kernel's ksmbd (kernel SMB daemon) implementation, specifically within the get_file_all_info() function. When vfs_getattr() fails, the function returns immediately without freeing the allocated filename buffer, resulting in a kernel memory leak. The vulnerability was published on January 23, 2026, and affects multiple Linux kernel stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium), with local attack vector and high availability impact (Red Hat CVE, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In get_file_all_info(), a filename buffer is allocated before calling vfs_getattr(); if that call fails, the error-handling path returns without invoking the corresponding free operation, leaking the allocated memory back to the kernel pool. Exploitation requires local access with low privileges — an attacker can repeatedly trigger the vfs_getattr() failure condition through file attribute retrieval operations on the ksmbd service. Affected kernel versions include 6.6.24–6.6.119, 6.7.12–6.7.x, 6.8.3–6.12.63, and 6.13–6.18.3, as well as 6.19-rc1 through rc3 (Feedly, Red Hat CVE).

Successful exploitation allows a low-privileged local attacker to exhaust kernel memory over time by repeatedly triggering the memory leak, leading to denial of service through system instability, service degradation, or a complete system crash. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running ksmbd as an SMB file-sharing service are most at risk, particularly those where untrusted local users can interact with the service (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Patches have been committed to the Linux kernel stable trees and are available for the affected branches. Fixed versions include 6.6.120, 6.12.64, 6.18.4, and later releases. Administrators should update to a patched kernel version as the primary remediation. As interim mitigations: disable ksmbd if SMB sharing is not required, restrict local user access to systems running ksmbd, and monitor kernel memory usage for unexplained depletion on vulnerable systems (Red Hat CVE, Feedly).