CVE-2026-23205: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23205 is a memory leak vulnerability in the Linux kernel's SMB/CIFS client implementation, specifically within the smb2_open_file() function. Objects allocated in the cifs_small_rq slab cache are not properly released after their effective lifetime ends, causing the kernel memory cache shutdown to fail with a BUG warning when the CIFS module is unloaded. The vulnerability was published on February 14, 2026, and patches were released on March 18, 2026. Affected kernel versions span multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When a CIFS share is mounted and write operations are attempted on a read-only export, smb2_open_file() fails to free allocated request buffers in certain error paths, leaving objects stranded in the cifs_small_rq slab cache. The bug manifests as a kernel BUG warning during kmem_cache_destroy() when the CIFS module is subsequently unloaded via modprobe -r cifs, as the slab cache still contains live objects. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (Feedly, Kernel Patch).

Exploitation of this vulnerability results in a denial-of-service condition affecting system availability. Memory leaks accumulate during CIFS file operations, and when the CIFS kernel module is unloaded, the kernel emits BUG warnings and the module cleanup fails, potentially destabilizing the system. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (A:H) on the local system (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() or kmem_cache_destroy cifs_small_rq: Slab cache still has objects.
• Logs: Stack traces referencing cifs_destroy_request_bufs, cleanup_module [cifs], and __se_sys_delete_module in kernel logs.
• Process: Execution of modprobe -r cifs followed immediately by kernel WARNING messages from mm/slub.c or mm/slab_common.c.
• System: Gradual increase in slab cache memory usage observable via /proc/slabinfo for the cifs_small_rq cache during repeated CIFS mount/write/unmount cycles.

Update the Linux kernel to a patched version addressing this issue. The following stable branch upgrades resolve CVE-2026-23205 (Feedly, Kernel Patch):

• Kernel 6.1.141–6.1.162 → upgrade to 6.1.163 or later
• Kernel 6.6.93–6.6.123 → upgrade to 6.6.124 or later
• Kernel 6.12.31–6.12.69 → upgrade to 6.12.70 or later
• Kernel 6.14.9–6.18.9 → upgrade to 6.18.10 or later
• All 6.19-rc1 through 6.19-rc8 releases

As a temporary workaround, avoid repeatedly mounting CIFS shares and unloading the CIFS kernel module on affected systems. Restrict CIFS module usage until patches are applied, and monitor slab cache memory for anomalies.