CVE-2026-23228: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23228 is a resource leak vulnerability in the Linux kernel's ksmbd SMB server component, specifically in the ksmbd_tcp_new_connection() function. When kthread_run() fails during TCP connection initialization, the transport is freed via free_transport() without decrementing the active_num_conn counter, causing the counter to leak. The fix replaces free_transport() with ksmbd_tcp_disconnect() to properly manage the counter. Affected Linux kernel versions include 5.15.91–5.15.200, 6.1.9–6.1.163, 6.2-rc6 through 6.2, 6.2.1–6.6.124, 6.7–6.12.71, and 6.13–6.18.10, as well as Microsoft's CBL-Mariner and Azure Linux kernel packages. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) — specifically, a counter resource leak rather than a heap memory leak. In ksmbd_tcp_new_connection(), when kthread_run() fails to spawn a handler thread, the error path calls free_transport() to release the transport structure but omits the corresponding decrement of the active_num_conn connection counter. Over time, repeated connection failures accumulate phantom increments in this counter, eventually exhausting the maximum allowed connection count and preventing new legitimate connections. The attack vector is local (AV:L), requiring low privileges, with no user interaction needed (Feedly).

The primary impact is a denial of service (DoS) against the ksmbd SMB server: as active_num_conn becomes exhausted due to accumulated leaked increments, the server can no longer accept new SMB connections, effectively taking the file-sharing service offline. There is no confidentiality or integrity impact — the vulnerability does not expose data or allow unauthorized modification. Systems running ksmbd as a network file server are most at risk, particularly in environments where connection failures (e.g., due to resource pressure or network instability) occur frequently (Feedly).

Patches are available across all affected kernel stable branches. Administrators should upgrade to one of the following fixed versions: Linux kernel 5.15.201 or later (5.15 series), 6.1.164 or later (6.1 series), 6.6.125 or later (6.6 series), 6.12.72 or later (6.12 series), 6.18.11 or later (6.18 series), or 6.19.1 or later. Patches are available via the Linux kernel stable repositories at git.kernel.org, Red Hat, Microsoft (for CBL-Mariner/Azure Linux), and Debian (DSA-6163-1, DLA-4499-1). As a workaround, organizations that do not require SMB server functionality should disable the ksmbd kernel module. Monitoring active_num_conn values and connection failure rates can help detect anomalous counter accumulation (Feedly, Microsoft MSRC, Debian LTS).