CVE-2025-71220: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71220 is a missing error-handling vulnerability in the Linux kernel's SMB/server (ksmbd) module, specifically in the create_smb2_pipe() function. When ksmbd_iov_pin_rsp() fails, the function omits a required call to ksmbd_session_rpc_close(), resulting in improper RPC session cleanup and potential resource leaks. The vulnerability affects Linux kernel versions 5.15.145–5.15.199, 6.1.71–6.1.162, 6.6–6.6.123, 6.7–6.12.69, and 6.13–6.18.9, as well as release candidates 6.19-rc1 through rc3. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is improper resource cleanup (CWE-404 / missing error handling) in the ksmbd SMB server implementation within the Linux kernel. When ksmbd_iov_pin_rsp() returns an error in create_smb2_pipe(), the code path exits without invoking ksmbd_session_rpc_close(), leaving the associated RPC session handle open and uncleaned. This local attack vector requires low privileges and no user interaction, and can be triggered by a local user interacting with the SMB server subsystem in a way that causes ksmbd_iov_pin_rsp() to fail. Patches addressing this issue are available in the upstream kernel stable trees (Kernel Patches).

A local attacker with low privileges could exploit this vulnerability to cause resource leaks, denial of service conditions, or system instability on affected Linux systems running the ksmbd SMB server. The improper RPC session handling may lead to memory exhaustion over time or state corruption within the SMB server, potentially affecting confidentiality, integrity, and availability of the system. The vulnerability's scope is limited to the local system and does not directly enable remote code execution or lateral movement (Feedly).

Upgrade to a patched Linux kernel version: 5.15.200 or later, 6.1.163 or later, 6.6.124 or later, 6.12.70 or later, or 6.18.10 or later, depending on the active kernel branch. Debian and Ubuntu have issued security advisories and updated packages addressing this vulnerability. For systems that cannot be immediately patched, restrict local user access and consider disabling the ksmbd SMB server module if it is not required. Monitor SMB/CIFS server activity for anomalous patterns as a compensating control (Feedly, Debian LTS Announce, Ubuntu USN-8278-1).

Debian issued security advisories (DSA-6141-1, DSA-6163-1, DLA-4499-1) and Ubuntu published multiple security notices (USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, USN-8296-1, USN-8296-2, USN-8393-1) addressing this and related kernel vulnerabilities. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified (Debian LTS Announce, Ubuntu USN-8278-1).