CVE-2026-23205

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix memory leak in smb2_open_file()

Reproducer:

1. server: directories are exported read-only

2. client: mount -t cifs //${server_ip}/export /mnt

3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct

4. client: umount /mnt

5. client: sleep 1

6. client: modprobe -r cifs

The error message is as follows:

=============================================================================

BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()

-----------------------------------------------------------------------------

Object 0x00000000d47521be @offset=14336

...

WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577

...

Call Trace:

<TASK>

kmem_cache_destroy+0x94/0x190

cifs_destroy_request_bufs+0x3e/0x50 [cifs]

cleanup_module+0x4e/0x540 [cifs]

__se_sys_delete_module+0x278/0x400

__x64_sys_delete_module

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References