CVE-2025-39720 (GCVE-0-2025-39720)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:21 – Updated: 2026-08-05 12:04
VLAI
Title
ksmbd: fix refcount leak causing resource not released
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix refcount leak causing resource not released When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < a1d2bab4d53368a526c97aba92671dd71814f95a (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 36e010bb865fbaa1202fe9bcce3fd486d6db7606 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 89bb430f621124af39bb31763c4a8b504c9651e2 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a1d2bab4d53368a526c97aba92671dd71814f95a",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "36e010bb865fbaa1202fe9bcce3fd486d6db7606",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "89bb430f621124af39bb31763c4a8b504c9651e2",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/oplock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix refcount leak causing resource not released\n\nWhen ksmbd_conn_releasing(opinfo-\u003econn) returns true,the refcount was not\ndecremented properly, causing a refcount leak that prevents the count from\nreaching zero and the memory from being released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in ksmbd, the in-kernel SMB server listening on TCP/445, and is driven entirely by remote SMB2 CREATE/WRITE/CLOSE traffic and connection teardown. No local access is needed.\nAC:L - The leak is deterministic, not a race: `ksmbd_conn_set_releasing()` runs before the file table is torn down, so `smb_lazy_parent_lease_break_close()` always sees the connection\u0027s own v2 directory-lease opinfo with `conn` already RELEASING. The multi-connection variant against `smb_break_all_levII_oplock()` is also fully attacker-controlled and the window can be widened at will by keeping a request pending.\nPR:N - ksmbd supports guest/anonymous sessions (`user_guest()`, `SMB2_SESSION_FLAG_IS_GUEST_LE`), so on the guest-mapped shares typical of NAS and embedded deployments an unauthenticated client can open a file with a lease and reach these paths; otherwise only an ordinary unprivileged SMB account is needed.\nUI:N - The attacker triggers everything itself by opening a leased handle and closing the connection; no action by any local user or administrator is involved.\nS:U - The leaked allocations and the resulting exhaustion are confined to the kernel\u0027s own memory, the same security authority as the vulnerable ksmbd code. No boundary such as VM or IOMMU is crossed.\nC:N - Nothing is freed early, read out of bounds, or copied to the client; the only effect is that objects are never released. No kernel data or pointer value is exposed.\nI:N - No memory is overwritten and no file or kernel state is modified incorrectly; the reference count simply never reaches zero.\nA:H - Each trigger permanently leaks an `oplock_info`, `lease`, the whole `ksmbd_conn`, the `tcp_transport`/iov, and the accepted TCP socket (since `sock_release()` only runs on the final conn put), and it can be repeated per connection without bound, driving the kernel to unreclaimable memory exhaustion and OOM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:51.277Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a1d2bab4d53368a526c97aba92671dd71814f95a"
        },
        {
          "url": "https://git.kernel.org/stable/c/36e010bb865fbaa1202fe9bcce3fd486d6db7606"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/89bb430f621124af39bb31763c4a8b504c9651e2"
        }
      ],
      "title": "ksmbd: fix refcount leak causing resource not released",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39720",
    "datePublished": "2025-09-05T17:21:28.060Z",
    "dateReserved": "2025-04-16T07:20:57.117Z",
    "dateUpdated": "2026-08-05T12:04:51.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39720",
      "date": "2026-08-05",
      "epss": "0.00261",
      "percentile": "0.17675"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39720\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-05T18:15:49.643\",\"lastModified\":\"2026-07-30T06:23:42.940\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix refcount leak causing resource not released\\n\\nWhen ksmbd_conn_releasing(opinfo-\u003econn) returns true,the refcount was not\\ndecremented properly, causing a refcount leak that prevents the count from\\nreaching zero and the memory from being released.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/oplock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"a1d2bab4d53368a526c97aba92671dd71814f95a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"36e010bb865fbaa1202fe9bcce3fd486d6db7606\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"89bb430f621124af39bb31763c4a8b504c9651e2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/oplock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.44\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"BEB32BA8-CEE4-4F72-BB1A-90B3AF6DBC43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.44\",\"matchCriteriaId\":\"12351F24-1133-4775-960C-F2B47E81298B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.4\",\"matchCriteriaId\":\"AFC28995-B8C3-4B68-8CB6-78E792B6629D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36e010bb865fbaa1202fe9bcce3fd486d6db7606\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89bb430f621124af39bb31763c4a8b504c9651e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a7abce6e8c0e2145b346a6d4abf0d9655e9b0e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1d2bab4d53368a526c97aba92671dd71814f95a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:30:00+00:00",
      "cve": "CVE-2025-39720",
      "id": "CVE-2025-39720",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix refcount leak causing resource not released",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39720.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T23:33:25Z",
      "cve": "CVE-2025-39720",
      "id": "CVE-2025-39720",
      "initial_release_date": "2025-09-05T23:22:49Z",
      "product_status:known_not_affected": "416",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39720",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39720.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.