CVE-2025-71223: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71223 is a reference count leak vulnerability in the Linux kernel's SMB/server (ksmbd) component, specifically in the smb2_open() function. When ksmbd_vfs_getattr() fails, the reference count of the ksmbd_file structure is not properly released, leading to a kernel resource leak. The vulnerability was published on February 14, 2026, and affects Linux kernel versions 6.6.32–6.6.123, 6.9–6.12.69, and 6.13–6.18.9, as well as release candidates 6.19-rc1 through 6.19-rc3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the smb2_open() function within the Linux kernel's ksmbd SMB server implementation. When the ksmbd_vfs_getattr() call fails during file open processing, the error handling path does not decrement the reference count of the associated ksmbd_file object, causing it to never be freed. This is a local vulnerability requiring low privileges — an attacker with local access can trigger repeated SMB file open operations that cause ksmbd_vfs_getattr() to fail, accumulating unreleased references over time. Patches addressing this issue are available across multiple stable kernel branches (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation leads to a denial-of-service condition through gradual kernel memory exhaustion. As unreleased ksmbd_file reference counts accumulate, kernel memory resources are consumed without being freed, eventually causing the system to become unresponsive or crash. There is no confidentiality or integrity impact — the vulnerability is limited to availability, affecting the local system running the ksmbd SMB server (Feedly).

Update to a patched Linux kernel version: 6.6.124 or later, 6.12.70 or later, or 6.18.10 or later. Patches have been committed to the stable kernel tree across four commits targeting the affected version ranges (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3, Kernel Patch 4). As a workaround where patching is not immediately possible, disabling the ksmbd kernel module (if SMB server functionality is not required) or restricting local user access to SMB server operations can reduce exposure (Feedly). Debian has also issued an advisory (DSA-6141-1) covering this and related kernel fixes (Linux Security).

Debian issued a security advisory (DSA-6141-1) addressing this vulnerability as part of a broader Linux kernel update (Linux Security). Tenable's Nessus scanner (plugin 299095) and Qualys have added detection for this CVE, indicating uptake among vulnerability management vendors (Feedly). No notable researcher commentary or significant social media discussion has been observed.